5

My goal is to SSH into my Pi on my LAN (local area network) from WAN. Basically, I want to SSH to a Pi that is at home and that is connected to the router from places like school or work.

I thought that I would try opening a port on my router so I went to my routers NAT settings and changed service to SSH (since thats what I want, right?).

enter image description here

I am later going to put Pi's local IP in the "Server IP Adress" bar. But I am somewhat uncertain whether it would be (somewhat) secure if I were to open a port like that. Like, is that all it takes? I am new to the networking scene and hence lack experience in this regard.

Improve this question
4
  • You will also need a way to find the public IP of your router. Many routers integrate with services like dyndns for this.As for security this is in no way secure. There are malicious scans performed against all public IP's regularly, and the Pi has a well known username and password. Before you reply that you plan to change one or the both of them - remeber that it is only the first step in ptoperly protecting access to your Pi. Also, this puts every other computer.device on your network at increased risk. While the value of the data on the pi may be low.
    – Steve Robillard
    Commented Apr 30, 2017 at 23:46
  • Can the same be said for your other computers where you likley shop online, conduct onlne banking etc.
    – Steve Robillard
    Commented Apr 30, 2017 at 23:47
  • You can only do it when your ISP is providing you public IP address. DNS service just point your domain to public IP.
    – Arpit Agarwal
    Commented May 1, 2017 at 11:09
  • You can use a server to do it. RPi will always be connected to server. From your school, you can connect to server. It will work as a bridge.
    – Arpit Agarwal
    Commented May 1, 2017 at 11:13

3 Answers 3

Reset to default
1

If you open your Raspberry Pi's SSH port on the internet, there are two things you will need to know:

  1. You cannot access your Pi just by port forwarding! (Unless you have a static IP address)
    You will need to register an account with a "dynamic dns" service after port forwarding. I recommend duckdns.org.
  2. Port forwarding your Pi will lead to a serious vulnerability in your Pi if you have not changed the default password.

That said, port forwarding is your only option if you want to remotely access your Pi. However, do it wisely. Google is your friend if you want to research this.

Improve this answer
6
  • 2
    You really don't "need" a ddns service, that's just a way to avoid having to remember or write down your current public ip address, you can ssh into your rpi with just the public password just fine.
    – arielnmz
    Commented May 1, 2017 at 0:28
  • 1
    @arielnmz that assumes you have a static or seldm changing IP address.
    – Steve Robillard
    Commented May 1, 2017 at 1:26
  • That's why I said that you don't have to write it down, it's just that you have to check it every now and then in case it changes. Sry password→address.
    – arielnmz
    Commented May 1, 2017 at 1:40
  • @arielnmz And what happens the one time when it changes IP while out for whatever reason? Dynamic DNS even with a static IP provides a more fullproof solution.
    – Steve Robillard
    Commented May 1, 2017 at 3:44
  • 2
    Of course it does, I think you don't get the point that for ssh to work you don't need ddns, but you can use ddns if you want a better experience (not just for ssh but for hosting your own services as well).
    – arielnmz
    Commented May 1, 2017 at 4:58
1

What you are describing should open up SSH access to your raspberry pi from the whole internet.

There is certainly risk involved in doing this - anyone able to login to the pi (for example by guessing your username and password) would take complete control of you Pi and have full access to your home network. This is something you want to avoid.

However, there are options to mitigate this risk - for example disabling password login and using public key authentication. You must also ensure that you keep your software up to date. Nothing can guarantee total safety.

What you want to do is not an uncommon thing to do but it's important to be aware of the risks.

Improve this answer
1

I'm not sure your level of commitment to this, but I use OpenVPN on my Rpi to tunnel into my home network. Bonus, it's also a free VPN service I can now use on public wifi. I tried rolling my own OpenVPN server, but soon after found pivpn and love it. So easy to set up. pivpn, if you're interested

Now whenever I need access to my server for ssh or smb shares while on the road, I just connect to the vpn and then act as if I'm on my home network.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.