Setting up SSH over internet on my Pi

Question

This might be a simple question, but as I have read contradicting information from several resources (what? contradictions on the internet?) I wanted to know if I did everything I was supposed to.

So I want to set up a SSH connection to my RasPi so that I can access it over the internet.

1. I started by activating SSH on the Pi, running Raspbian, using the raspi-config tool.
2. Then, I installed the no-ip.com client on my Pi to have a host name pointing to my dynamic ip address.
3. I looked up my LAN ip on my raspberry using ifconfig
4. Finally, in my router's configuration utility, under port forwarding, I enabled forwarding of port 22 in both TCP and UDP to the local ip of my pi.

After this, I can't seem to SSH to my pi via internet. It works when I try to connect inside my LAN using my local ip, but not using my host name or internet ip address. I have also tried connecting from a different location and nothing works.

My question: Am i missing any steps? Are there config files I should be editing on my pi to make everything work?

Answer 1

If you only plan to connect to your Raspberry Pi via SSH over the internet, probably ngrok.com may suit your problem in the most comfortable way.

It forwards your port(s) with some kind of a reversed tunnel and can even help bypassing firewalls or restrictions of your ISP. You have to register (for free) on the site to forward TCP-traffic.

I am not affiliated with this project in any way; I just used it to accomplish the very same idea (in my case forwarding a OpenVPN-Server) and did so far not encounter any problems.

Answer 2

Part of your issue could be that because the Pi is using a dynamic IP from the DHCP on your router, the port forwarding you set up isn't working, as the Pi's local IP has changed.

The simplest way to fix this (at least that I have seen) is to set up a static IP. It's relatively simple, so long as you don't mind mucking about in a config file. You can read a little more in depth here and here. I'll also explain the simple way below:

1. Connect to your Pi either via SSH within your home network or via a screen, either works.

2. Grab a pen and some paper, you're going to be writing down some info.

3. Run the command ifconfig. I know you already ran it, but we need to gather a little more info that your local IP this time. This reveals your router information, the bit you want is after eth0 (the ethernet connection). . . .

   eth0      Link encap:Ethernet  HWaddr b8:27:eb:b3:fc:2c
             inet addr:192.168.1.81  Bcast:192.168.1.255  Mask:255.255.255.0
   

   Write down the following information...

   inet addr – 192.168.1.81 (Pi's Current IP Address)
   Bcast –  192.168.1.255 (The Broadcast IP Range)
   Mask –  255.255.255.0 (Subnet Mask Address)
   

   Obviously, your info will be different from this tutorial, so make sure you use your info from the ifconfig command run on the Pi.

4. Now run netstat -nr or route -n. We need:

   'Gateway' Address – 192.168.1.254
   'Destination' Address – 192.168.1.0

5. Now that we have that info, we can edit the interfaces file to set up the dynamic IP. Run sudo nano /etc/network/interfaces. It should look somewhat like this:

   

6. Change the line:

   iface eth0 inet dhcp
   

   to

   iface eth0 inet static
   

   Then directly below this line enter the following (Please Note. You will need your own addresses we gathered above). . . .

   address 192.168.1.81
   netmask 255.255.255.0
   network 192.168.1.0
   broadcast 192.168.1.255
   gateway 192.168.1.254
   

   Basically, the address part is what you want your IP to be. Higher is better, as there is less chance of IP conflicts. netmask – The 'Mask' address we wrote down earlier.

   network – The router IP address, this is the 'Destination' Address was found earlier. You can also grab this off your router, it should say on the side somewhere.

   broadcast – The 'Bcast' address we wrote down earlier.

   gateway – This is the 'Gateway' address we found earlier.

   Press Ctrl+O and either Enter or Y and then Enter. Once you've done that press Ctrl+X.

7. Run sudo reboot and your IP should be in place! Log back in and run the ifconfig command again, and it should look like this now:

   

Then configure your port forwarding to your new static IP, and it should all work! Best of Luck!

Answer 3

The only thing you seem to have misconfigured is that SSH is a TCP only protocol, so you do not need to forward UDP traffic on port 22.

Now why it does not seem to work is probably because your router does not support NAT loopback. What it means is that the NAT rules (such as your forwarding one) are not applying when the origin of the connection is from your internal LAN. Not all routers have this feature ON. Thus if your router does not support NAT loopback, then you will not be able to connect to your RPi using SSH when using the no-ip.com domain name and when doing it from your LAN.

To try if your configuration is working, if you have a smartphone with some data connection (3G, LTE, etc.) and there is an ssh client on it, try to connect to your RPi using the data plan and not your WiFi connection. If you don't have an ssh client on it and you are allowed to do tethering, then use your smartphone together with one of your computer by unplugging it for your local network and using the tethering link instead.

Answer 4

The local IP address of your Raspberry Pi is not fixed, unless you are using a wireless adapter to connect, which will keep its IP address. If you want to use SSH for the RPI, you can use these steps:

Start up your Pi to the terminal prompt. Type the following command "sudo apt-get install xrdp" If promoted enter your password (the default is "raspberry") Type "Y" and press enter. This is now installing xrdp onto your Pi which is the software we are going to use for the remote desktop connection. Wait for it to complete. Restart your Pi. We are going to check that xrdp is going to start up automatically. When your Pi has booted to the command prompt look for [ ok ] Starting Remote Desktop Protocol server : xrdp sesman. This shows you that xrdp is installed and automatically starting up on start up of your Pi The last step is to make a note of the IP address of your Pi which should also be displayed on the start up screen. In my case below it is 192.168.1.9. This is the address of your Pi on your network and what we will use to connect to your Pi from the second machine.

Second Machine Setup

1. Launch Remote Desktop Connection which can be found at Start->All Programs->Accessories->Remote Desktop Connection

2. Type in the IP Address for your Pi which you noted above.

3. Click Connect (you may get a security warning at this stage just click OK if you do. After all it is your Pi on your network so nothing to worry about security wise).

4. Leave the Module on the default of sesman-Xvnc and enter your username and password for your Pi. (The default is pi and raspberry if you haven't changed them).

5. Click OK and after a few moments you should be greeted my your Raspberry Pi's desktop!

6. When you are finished simply log-out from the Pi's desktop.

I found these step from here and they worked for me

Here is another way to use SSH:

SSH into Raspberry Pi I generally log into my Raspberry Pi via SSH, or Secure Shell to give it its full name. This allows command line access, to your Raspberry Pi, from another computer. Although it is possible to SSH into the Raspberry Pi from anywhere in the world, and I do, this post only covers SSH access over the local network. I will cover remote connection in a future blog post.

Although this does not give access to a GUI (Graphical User Interface), having access to the command line generally allows me to do 95% of what I need to do. The other 5% I could probably do through SSH, but sometimes you can't beat the comfort of a GUI. :-)

First of all you need to know the IP address of the Raspberry Pi you are wanting to log into. If you are unsure how to find this, then read my blog post explaining how you can do this remotely using an excellent tool called nmap.

To SSH into your Raspberry Pi from a Linux or Apple Mac computer this is very easy. You can just type your username and IP address into the command line using the following format:

ssh username@IPaddress

Ensure you substitute username with the username you are wanting to log into the remote computer with. The IP address should take the format 192.168.1.66

You may get a message explaining that the authenticity of the host cannot be established, and if you are sure you want to continue connecting. You will only see this message the first time you SSH into your Raspberry Pi. Simply type yes.

You will then be asked for your password, enter the password for the username you are trying to connect with.

For windows this is a little more tricky to set up as it requires an additional piece of software called PuTTY. However once installed this is really simple to use.

First go to the PuTTY website, www.putty.org, download and install the software.

Once installed load PuTTY

Under Host Name (or IP address) type in the IP address you would like to connect to. Select the SSH radio button. In the box under Saved Sessions type in a name to identify this computer, such as Raspberry Pi, and then click Save. Clicking on Open should now start your SSH session.

Next time you want to SSH into your Raspberry Pi you just need to load PuTTY, click on the saved session to highlight it and then click Open. Once you have typed in your password, when asked, you have remote access to your Raspberry Pi.

I found these instructions from here

Answer 5

Try using a free domain name, for example co.cc or similar, and freeDNS (they also supply a large range of subdomains) to point to your router. I think you can also get an update script in case your router has a dynamic IP.

If that doesn't work, perhaps the settings for your port forwarding are wrong? What kind of router do you have?

Answer 6

To allow incoming traffic on the default SSH port (22), you could tell iptables to allow all TCP traffic on that port to come in.

sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT

Referring back to the list above, you can see that this tells iptables:

1. append this rule to the input chain (-A INPUT) so we look at incoming traffic
2. check to see if it is TCP (-p tcp).
3. if so, check to see if the input goes to the SSH port (--dport ssh).
4. if so, accept the input (-j ACCEPT).

Hopefully this works for you also you may want to add the ftp ports which are 20-21, just change the ssh to 20 and 21.

Answer 7

Im not sure if this question needs additional answers but its quite simple.

1. Install OpenSSH or enable it from raspi-config

2. Go to your router/firewalls home page in my case 192.168.1.1

3. Look for port forwarding or virtual servers and add something like the following:

   External Port start:1234 External Port end:1234

   Internal port start and end 22.

   Server IP is the static IP of your RPi in my case 192.168.1.50

4. Once it is all set up on the router side make a note of your WAN IP by searching for your IP on Google.

5. Now you should be able to SSH to the pi over the internet. In my case I am using a Chromebook and the secure shell add on. I type in the username in my case pi@mywanip and port 1234.

Basically the firewall rule in step 3 forwards all traffic on WAN IP's port 1234 to internal LAN IP's port 22.

Answer 8

I have this situation here in Finland: rpi is connected to mobile wifi router, huawei e5776, and I want to connect to rpi with SSH over internet, with no success so far and finally I know it's my Internet Service Provider blocking two way connections for mobile broadband customers. Two way traffic for them is extra service, (which you have to pay for) called open gate by my ISP. So head to your own ISPs site to see if that is the case.

Answer 9

Slubbix pointed to a possible problem that the local IP address of the Raspberry Pi is not fixed. This would make the port forward in your router unreliable. By default the Raspberry Pi is configured to use DHCP. This means that the IP is given by the router. This IP is by default also not fixed.

One solution to this problem is already indicated by Slubbix: to make the IP of the Raspberry Pi fixed.

In my opinion this has two disadvantages: there is no global list of IPs in your network that is easily maintained and you can't use your Raspberry Pi in another network (IP already on use or different submask).

Therefore I propose to do the following: configure your router to assign a fixed IP to the MAC address of your Raspberry Pi. The MAC address can be found using the command ifconfig

Answer 10

One thing that I noticed for my internet is that when I port forwarded my webserver and I tried to connect to it using my public ip it would say that it was not available, but when I connect to it on my phone or on my schools network I am able to connect to it, also one thing you could try to do is go to google and type in "IP" into the search bar, copy the ip it gives you and then go to google translate and paste in your ip, and then click on the blue ip address in the right window, and that should show you if you successfully portforward your web server.

Answer 11

I struggled a lot with setting up SSH via internet until I found this simple method:

http://raspctl.com

Just register and copy-paste the commands. You may need to edit a config file but that's it. I tested it today and it works like charm. I tried it with different SSH android apps, too.

Answer 12

Full disclosure: I am the founder of SocketXP.

Setting up port-forwarding on your home or office router will punch a hole in your NAT/firewall rule table, which could be potentially exploited by a hacker in the internet. It is very confusing and complicated for novices.

There are free online services to securely remote SSH into your Raspberry Pi in your private home network without modifying anything in your router settings.

You could simply install SocketXP on your Raspberry Pi and remote SSH into your Raspberry Pi behind NAT router over the internet.

You can follow the instructions below to setup remote SSH access to your Raspberry Pi or IoT device:

Step#1 Download and install SocketXP into your RPi

curl -O https://portal.socketxp.com/download/arm/socketxp && chmod +wx socketxp && sudo mv socketxp /usr/local/bin

Step#2 Authenticate

Next register your device with SocketXP online service:

$ socketxp login <your-authtoken-goes-here>

Signup and get your authtoken from here for free.

Step#3 Connect and Access

$ socketxp connect tcp://127.0.0.1:22

Now go to https://portal.socketxp.com/#/devices and click the terminal icon next your device. Provide your Pi login/password. Boom and you are now placed inside your Raspberry Pi shell.

You can know more about how to setup remote SSH into Raspberry Pi to access over the internet here which has a single-touch command to do all of the actions listed above.