At a former company, we needed to connect to customer's databases from our service. Many were understandably cagey about opening a public hole in their firewall

At a former company, we needed to connect to customer's databases from our service. Many were understandably cagey about opening a public hole in their firewall to their DB, even if it's just for our single egress IP. Our solution was to run a public host (the Reverse Bastion) that would, upon user request, generate a shell-less linux account for the user and install their public key. The user was then given an SSH command to run from inside their corp network that would connect to Reverse Bastion and establish a reverse tunnel pointing at their database. That way we could "connect" to that user's dedicated port on the Reverse Bastion and our traffic would traverse the tunnel and pop out inside their network, bound for their database. Since it's all TCP tunneling, JDBC drivers had no idea they were hopscotching around networks and did DB queries like usual. As long as you have the user accounts totally locked down and people's port assignments locked to their users via iptables, it was a walled (tunneled?) garden.