17

I recently set up SSH on my Raspberry Pi. It has been going swimmingly, especially since I can control the computer through my iPhone with the app Server Auditor. Sadly, this only works through the local network.

How can I make my SSH work when I am out of the house? (Preferably works with the app.)

8
  • can you forward a port from your router?
    – SteveIrwin
    Apr 3, 2013 at 0:28
  • 1
    @SteveIrwin I most likely can, but since I am not networking-literate, I would prefer an easy solution such as Port Map. Actually... if I share my Mac's internet with my Pi, would I be able to share forwarded Ports? Apr 3, 2013 at 0:55
  • 1
    setting up a port forward is probably at least as easy as using Port Map. You need to tell us more about how your LAN is set up Apr 3, 2013 at 6:08
  • Your best bet is to install Weaved service (www.weaved.com), and be done with it. All the other tutorials you'll find on the internet will lead you down a frustrating road. Aug 7, 2016 at 23:55
  • for the post that suggests the usage of socketxp use the following to download socketxp in the RPI curl -O portal.socketxp.com/download/arm/socketxp && chmod +wx socketxp && sudo mv socketxp /usr/local/bin instead of linux file.
    – jeonghoon
    Oct 26, 2019 at 19:19

10 Answers 10

20

Here are the steps I used (on debian) which you might find useful.

1.Setting Static IP for the Pi.

a.Open the interfaces file using the command

sudo nano /etc/network/interfaces

b.Change the interfaces file to the following (This works for me I am not sure if a few of the lines can be excluded).

auto lo
iface lo inet loopback
iface eth0 inet static
address 192.168.1.2  #static ip you want for the pi
netmask 255.255.255.0
gateway 192.168.1.1    # the ip address of the router

c.Check if the Ip is changed using the ifconfig command

2.Setting up a dynamic DNS

Most probably the IP address assigned by your ISP is dynamic and so we need a way to resolve the changes in IP address.I use dnsdynamic and ddclient software to achieve this.Both are free to use.

a.Sign up for a account with dnsdynamic

b.Add a new domain and select a name and the domain from the list.You can choose any of the available domains with your choice of subdomain.Click on check availabilty and then add

dnsdynamic screenshot

3.Setting ddclient on Pi

a.Install ddclient using the command

sudo apt-get install ddclient

b.Open the configuration file for ddclient using the following command and add the following lines.

sudo nano /etc/ddclient.conf

and change the file to the following.

# /etc/ddclient.conf
daemon=600
timeout=10
ssl=yes
protocol=dyndns2
use=web, web=myip.dnsdynamic.com
server=www.dnsdynamic.org
[email protected]  #userid for dnsdynamic.com
password='xxxx'      #password for the same put inside quotes
x.dnsdynamic.com  #the domain name you created

and save the file.

d.We want the ddclient service to start automatically on reboots.So do the following.

sudo nano /etc/rc.local

Add the following command before exit 0(which is the last line)

sudo /usr/sbin/ddclient -daemon 600 -syslog

Save the file.To start ddclient either reboot your pi or execute the above command on the prompt.It will keep your domain name updated with the current ip address changing when necessary.

4.Port Forwarding

a.Find the model of your router.

b.Go to portforward.com

c.Enter your router brand and model to find the detailed guide on forwarding port.

d.After selecting the router brand and model, Click on the Default guide from the redirected page.

e.In the Static Ip Text Box, Enter the Static IP of the Pi you gave in Step 1.

f.Follow the steps and forward port 22.The source port needs to be 22 and the destination port can be anything.Please remember to use the Destination Port when sshing into pi.To avoid confusion,I tend to use the same Source and Destination port.

If you were following the tutorial, Login to your pi from anywhere by using replacing the ip address with the domain name. eg- I use [email protected]:22 to ssh into my pi.

3
  • Thanks so much! When I get back from visiting Exeter I will try this out! Apr 3, 2013 at 21:18
  • +1 Great answer, however, do you really need to use sudo in /etc/rc.local, isn't that already running as root? Sep 25, 2013 at 20:49
  • Thus totally screwed up my Ngrok and Weaved configurations. Now I cannot connect at all! Aug 7, 2016 at 23:48
3

First you'll want to set up port forwarding. Each router is slightly different, so you'll have to look up the specifics for your router.
There are generic port forwarding how-to guides that can work for most routers, but I'd suggest finding a guide for your actual router model.

Set a memorable port to link to your raspberry pi, such as 23456 or something. Be careful not to overwrite common port numbers.

Finally, using ssh do the following:

$ ssh -p 23456 user@IP

Where:

3
  • Why can't I use port 22 instead of the custom 23456? Aug 12, 2016 at 15:55
  • 1
    @IgorGanapolsky you can do that, but 1) if you have another computer you'd like to connect to through SSH outside of your home, there will be a conflict and 2) more risky since many "hackers" try to login through port 22, so closing it off is often recommended on servers
    – meneldal
    Feb 24, 2019 at 10:59
  • to use a custom port, does the sshd on the RPi need anything special set up? it seems to give "connection refused" for any argument except 22.
    – Bonlenfum
    Mar 29, 2021 at 16:20
2

This question is old, as time goes on there are fewer chances of you getting a public accessible IPv4-address. Most likely you are behind a CGNAT, meaning you share a single public IPv4 with other customers of the ISP. So it is not possible to do a port-forward to your PI or anything else.

If you have IPv6, you can give your PI a static address, and allow access to it on your router. Many mobile providers now give IPv6 to phones. The old "land-based" ISPs (Fiber, DSL, coax etc) are often dragging their feet.

You could also get a cheap VPS (virtual private server) with a public IPv4 somewhere in the cloud, and make a SSH-tunnel from the PI to the VPS.

1

Full disclosure: I am the founder of SocketXP.

Accessing your RaspberryPi ( or even laptops/servers) from outside your home network (meaning, from the internet) is not an easy task, because your home laptop or RaspberryPi has only local IP address ( in the 10.x.x.x range or 192.168.x.x range). It doesn't have a Public IP address that is visible from the Internet.

The simple answer to your question is use free online services like SocketXP which provides a secure public tunnel endpoint to SSH into your RaspberryPi from outside the home network.

SocketXP provides a simple, secure and easy way to access your home RaspberryPi from the outside network. SocketXP doesn't require you to hack any settings in your WiFi router. It works out of the box. To know how to setup your RaspberryPi to SSH from outside, read this blog on how to remote SSH into your RaspberryPi using SocketXP.

How to setup SocketXP:

Step1: Install SocketXP client on your RaspberryPi using the following command.

$ curl -O https://portal.socketxp.com/download/linux/socketxp && chmod +wx socketxp && sudo mv socketxp /usr/local/bin

Step2: Connect SocketXP client with SocketXP Cloud Service using the following command. You need to register at https://portal.socketxp.com to get your unique auth-token.

$ socketxp -register "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1NDk1MTg0MDAsImlkIjoiZ2FuZXNodmVscmFqYW5AZ21ha6K208n0.cB2uYevpH4lWIQGQUJdQ0eiEDqS8OiP_YOiqernnui3rjjadfadsfsfas34"

Step3: Get a public tunnel endpoint to access your RaspberryPi from the internet.

$ socketxp -connect tcp://localhost:22

Tunnel Access -> tunnel.socketxp.com:35277

Step4: SSH into your RaspberryPi from the internet using the following command.

$ ssh [email protected] -p 35277

where "raspberry-username" is the username/password you use to SSH login to your RaspberryPi.

0

On top of phalt's answer, you should check out one of the dynamic DNS services, such as No IP. They allow you to access your home network under a static host name, although your IP address may change daily, due to your DSL or cable provider disconnecting you. They also have a nice getting started page, which also introduces you to setting up your router accordingly.

You may want to install the inadyn package on your Raspberry Pi to update your No-IP DNS entries, when the IP changes. You can do this by running:

sudo apt-get install inadyn

From the inadyn README I took this sample call:

inadyn --dyndns_system [email protected] -u USER-p PASS -a HOST

Hope this helps.

1
  • No-Ip has a DUC (dynamic update client), which will ensure your IP addr doesn't change. Aug 12, 2016 at 15:57
0

Additional to steve irwin's answer:

Step 1:

if you connect through wlan, use:

iface wlan0 inet static
wpa-ssid "xxx" #<=your ssid
wpa-psk "yyy"  #<=your pw
address 192.168.1.xxx #<=preferred static ip (xxx<255)
netmask 255.255.255.0
gateway 192.168.1.1 #<=router's ip

Step 2:

after you changed the above, you need to restart networking:

sudo /etc/init.d/networking restart
2
  • I also added 2 lines in front of the static block, auto wlan0 allow-hotplug wlan0 I found it in this post raspberrypi.stackexchange.com/a/10320/10148 I also tried to do it without them but something didn't work.
    – XandruCea
    Dec 31, 2013 at 19:23
  • This answer should be considered out-of-date due to changes in Raspbian's network configuration and init system.
    – goldilocks
    Apr 22, 2016 at 13:42
0

In addtion, some routers do have built-in support for some Dynamic DNS services, you may enable this option (if it exists) in your router to avoid installing the client on your PI (and saving a little overhead while your at it).

0

So, you have an ssh server (your Raspberry PI) behind a firewall (your router) and you want to connect it from anywhere. Lets assume your ssh server is properly setup, i.e. running 'ssh username@localhost date' on your Raspberry shows the current date/time.

You have to solve two problems:

  • Your router must forward a fixed port to your raspberry ssh port (usually 22).
  • You must know your routers public ip address (which usually changes on router reconnect and as much as once in 24h).

Port Forwarding & DynDNS

Solutions exist (as has been pointed out by others):

If correctly setup, connecting your rasbperry pi might be possible with:

ssh username@[yourIP] -p [port] 
# or using dyndns 
ssh [email protected] -p [port]

Using sshhub.de

Another very convenient solution, not mentioned so far, is SSHHub (disclamer, I am the author). It uses ssh's own forwarding to access your Rasperry PI from anywhere. Its reliable, free and pretty simple to setup. Register once:

ssh [email protected] register

run on your Raspberry PI:

while true; do ssh [username]@sshhub.de -R 22:localhost:22 -N -o ServerAliveInterval=10; sleep 10; done

...and thats it! You can connect your Raspberry Pi from anywhere:

ssh -J [username]@sshhub.de localhost
2
  • Hello and welcome to Raspberry Pi! Please take the tour and visit the helpcenter to see how things work here. Thank you for your contribution but please note that we kindly ask you to disclose your affiliation in your answers. (I assume that you are the author of the recommended software.)
    – Ghanima
    Jan 14, 2020 at 21:46
  • Thanks for pointing me in the right direction. I am the author. I certainly want to provide value with my answer for people looking for a solution. And I hope my does as well as sshhub itself.
    – Oliver
    Jan 14, 2020 at 22:58
0

This post is quite old and maybe this solution wasn't around when the OP asked the question.

Most of the answers here require port-forwarding which I personally don’t like, seeing as it isn't portable (not an option when using a sim card).

Based on this post, there’s an easy solution to access Raspberry Pi out side of the network - upswift.io, I tried it a few times, and it worked great for me. Free for hobby use with up to 3 devices which was exactly what I needed for the devices I use at home.

-1

You could use a VPN to enable incoming access to your pi. OpenVPN is one solution, which would require you to have a computer that is accessible from the internet (an incoming port). However, as long as you have one computer accessible, the other computers do not need to be as they can be clients to the OpenVPN server.

Another option would be to use a service such as ZeroTier, which provides centralized servers for creating a VPN, so you'd not need to run your own server. This is also free.

1
  • Another very good option is to use wireguard.
    – Ingo
    Jan 20, 2020 at 12:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.