diff --git a/pkgs/development/python-modules/sshtunnel/default.nix b/pkgs/development/python-modules/sshtunnel/default.nix
new file mode 100644
index 00000000000..ff9d77bc782
--- /dev/null
+++ b/pkgs/development/python-modules/sshtunnel/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi
+, paramiko
+, pytest
+, mock
+}:
+
+buildPythonPackage rec {
+  version = "0.1.5";
+  pname = "sshtunnel";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0jcjppp6mdfsqrbfc3ddfxg1ybgvkjv7ri7azwv3j778m36zs4y8";
+  };
+
+  propagatedBuildInputs = [ paramiko ];
+
+  checkInputs = [ pytest mock ];
+
+  # disable impure tests
+  checkPhase = ''
+    pytest -k 'not connect_via_proxy and not read_ssh_config'
+  '';
+
+  meta = with lib; {
+    description = "Pure python SSH tunnels";
+    homepage = "https://github.com/pahaz/sshtunnel";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 924a4e48d81..3092b2f1fbb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1301,6 +1301,8 @@ in {
 
   sshpubkeys = callPackage ../development/python-modules/sshpubkeys { };
 
+  sshtunnel = callPackage ../development/python-modules/sshtunnel { };
+
   sslib = callPackage ../development/python-modules/sslib { };
 
   statistics = callPackage ../development/python-modules/statistics { };