ssh -N -L 5433:db.internal:5432 bastion.example.com

# Then, in another shell:
psql -h localhost -p 5433 -U app mydb