How to remote to Raspberry Pi from outside local network?

Question

I have a Raspberry Pi, and I can connect to it and remote acccess it while I’m on my local network just by doing ssh pi@10.10.xxx.xxx. But now I want to be able to access it when I am on a completely different network, e.g. when I’m at home, or in a different state or something.

I know there’s something about an internal and external IP address. I’m completely new to this, and I generally don’t have much networking knowledge. I can connect to the raspberry pi using putty, etc., so I have that enabled via these instructions: https://www.raspberrypi.org/documentation/remote-access/ssh/unix.md Obviously ssh pi@10.10.xxx.xxx just times out (and I didn't expect this to work anyway

I checked this link out, but I'm okay with port forwarding if it is safe. How to connect to raspberry pi outside of local network without port forwarding

How do I accomplish this?

Do I need:

1) a static ip address? (http://sizious.com/2015/08/28/setting-a-static-ip-on-raspberry-pi-on-raspbian-20150505/)

2) Do I need the public IP? (https://unix.stackexchange.com/questions/49730/ssh-to-a-remote-computer-having-only-the-public-ip)

Answer 1

^{simulate this circuit – Schematic created using CircuitLab}

Assume you have a Raspberry Pi connected to your Router at home. Normally your router will give IP addresses to all devices attached to it.

In my example the Router assigns to the Raspberry Pi the IP of 192.168.0.101 This IP is only visible in your internal Network and not from the World Wild Internet. This means you can connect to your Raspberry, for example via ssh from your Notebook, which is also in the same subnet as your Raspberry.

Subnets: I do not want to get too much into detail about subnets, but to keep it simple, ipv4 addresses from 192.168.0.1 to 192.168.0.254 are in the same subnet of 192.168.0.* which is 255.255.255.0, while 192.168.0.* and 192.168.1.* are not in the same subnet of 255.255.255.0 but 255.255.0.0. You will generally only encounter 255.255.255.0 meaning that the first three ip (192.168.0.) number blocks must be equal, while the fourth block (192.168.0.101) must be unique in your network. Another annotation for ip 192.168.0.101 with subnet 255.255.255.0 is also 192.168.0.101/24

Back to topic So while all your devices attached to your Router are in the same subnet and will be able to directly communicate to each other, they are not directly reachable from the Internet. From a security stand point, that is desireble.

But if your Raspberry Pi should act as a server, for example a cloud-server you might want to connect to it with your smartphone when you are not at home. Now the question is: how do I connect to the IP 192.168.0.101 from the Internet. Here come NAT and Internal/External IP into play.

Your smartphone needs to know the external IP of your router. And your router needs to know, where to route your smartphone request. So if you type into your smartphones ssh app the external ip of your router the request has to be routed to your raspberry. ssh username@88.192.54.75:22 has to be routed to 192.168.0.101.

Portnumbers: Every service that you run on your server and that you want to reach via ipv4 or ipv6 is listening on a port. It is awaiting client requests of a specified format on a specified port. Let's assume you have a webserver installed in your raspberry. The webserver server is running at Port 80 and 443, your ssh-server is running at port 22 and so on. There are a few standard ports for the different services but you are free to change these port numbers to any number you like. For example you could change your ssh port number 22 to port number 45302 by modifying one line in your sshd_conf file on your ssh server. The SSH-Server in that case will expect SSH requests on port 45302. This in turn means that you would have to advice any ssh client to use that specified port when trying to connect to the server( otherwise the client would use the standard port which is 22 ). This is usefull if you want to prevent simple bots from connecting to your ssh server. Or in case you have multiple services of the same type (for example webserver) running, to prevent them from conflicting with each other.

Here is a list of standard ports.

If you like to check what services are actually awaiting a remote connection with their respective port number you can type sudo netstat -tulpen in the console.

Back to topic If you want to make a specific service available to the outside world you need to open or forward that port to the public. That means you need to open your router web-administration and configuration page https://192.168.0.1 and create a port mapping/forwarding/NAT rule for each service that you want to make available. So if your ssh server is running at port 45302 you will need to create a rule that maps external requests (from the internet) at port 45302 to the internal device 192.168.0.101 at port 45302. Now it should be possible to connect to your ssh server using your external ip address.

Static vs dynamic ip A static ip is great but not necessary. If you have a dynamic ip you will in fact encounter the problem that you external ip will change. Therefor your can create an account at a dynamic dns service provider with your own personal dns record / domain name ( in my example my-own-domain.dyndns.org). These dynamic dns provider give you the ability to create a dns record that will point to your router ip. Your router will advert the dyndns provider whenever your router ip changes.

There are a lot or dynamic dns providers available, but only a few will be supported by your router. Somewhere in your router administration and configuration page you should find a category or topic that is named DynamicDNS. There you see which are supported from your router manufacturer. Create an account at one of those providers. Than go back to your router config page and fill out the account login data form your dynamic dns provider. Now your router should automatically notify your dynamic dns provider when your ip changes and you will only need to memorize your domain name. So when connecting to your ssh server you will type the domain instead of your external ip like: ssh username@my-own-domain.dyndns.org:45302

security aspects Every service that is reachable from the outside world might be hacked one day. If some hacker gets into your raspberry because of whatever reason, he will be able to directly communicate to any of your device inside your local network. This allows the hacker to infect even more devices. Therefor a DMZ has been invented. This is an option in your router config that should tell the router to disallow connections from that device inside the dmz to other devices outside the dmz. I am not familiar with this and my router does not even have that option too.

I suggest to you to implement one more layer of security. So instead of opening one or more ports to the public for every service that you might want to use, you could create a vpn server on your raspberry pi (ipsec, openvpn, wireguard). Than you can connect to that from the internet and are able to use any service on that raspberry without the need to open more ports in your router. This reduces the attack surface to only one service - the vpn service itself. In my opinion wireguard is the best option here, because it has very high performance and is no chatty protocol at all. That means, if anybody does a port scan on your router, he will not be able to find out, that there is an open port pointing to the wireguard service.

Answer 2

1. yes, 2. yes.

What you want is to either set up a VPN for your network or to port forward your SSH port.

Port forwarding is pretty safe up to the extent that the server software receiving those connections is secure. Look into PiVPN if you want to set that up, or you can port forward 22 to the open internet.

SSH can be configured to use key-based exchanges which is far more secure than username/password. If you port forward SSH, then you'll want to set that up to prevent users guessing your credentials (or worse, using an exploit to get in). Additionally, Port 22 is a very commonly scanned and tested port on the open internet. (You can avoid that if you change which port is forwarded.)

A VPN is software on the client and server that routes all of the client's network traffic through the server's network, essentially making the client appear to be on the inside network of the server. This allows you to access your entire home network away, including your Pi. VPNs use key-based exchanges and are pretty secure when you create your own certificates (which any tutorial will walk you through).

You're free to choose whichever - if SSH is configured in key exchange mode either option is just as secure. It just depends on how much work you want to do to get there.

You would need the Pi to have a static IP internally, and you'd need to know your public IP. You have to hope your public IP is also static, because if it wasn't it would change every single day.

---

Edit 1: The private IP address for your Pi can be found by running ifconfig. By default, DHCP (Dynamic Host Configuration Protocol) may change your internal IP address every day or so, but you can make this static (google "raspberry pi static ip" or the like to figure out how). If you use the same ssh pi@10.10.x.x command every day and 10.10.x.x doesn't change, it's possible you already have a static IP setup for it.

The public IP address is the address of your entire network to the open internet, and it's what websites see. Googling "what is my IP" will show you what it is. If a connection comes in, by default it is dropped because the router won't know where to send it. Port forwarding tells the router that incoming packets on port X from the internet should be sent to Device 192.168.X.Y port Z on the inside. Any program (such as SSH or a VPN server) running on port Z on the inside is also visible to port X on the outside. So if your Pi runs an SSH server on port 22, and you have port 22 on the inside forwarded to port 40022 on the outside, the SSH server can be connected to from outside the network on port 40022. If it was running a VPN server instead, it would also be visible from the outside.

PiVPN is just a program that helps you setup an OpenVPN server on a Raspberry Pi. It walks you through configuring it and creating keys and the like.

Answer 3

This is more of an exercise for configuring your router, not your Raspberry Pi. But to keep it simple, here's what I do.

1. Unless you have a static IP with your internet provider, you'll want to configure Dynamic DNS into your router. I use duckdns.org, as they still freely allow you to configure one domain and not have to renew it every month. Essentially your router will keep your dynamic IP updated into a dns entry so you can go to "myawesomehomenetwork.duckdns.org", rather than trying to keep track of an IP that changes every so often. Most routers these days have a Dynamic DNS page you can configure this.

2. Setup a static IP for the PI on your internal network, again I'd do this on your router, you should have an interface to configure a mac address to have a specific IP.

3. Again on your router, port forward port 22 to your PI's static IP address.

4. Most importantly, make sure your router is properly firewalled. I use the port scanning tool "Shields Up" at https://www.grc.com/x/ne.dll?bh0bkyd2 You should only have port 22 open to the world! Everything else should come back as stealth. If you knew where you were connecting from, you could even write iptables rules into your pi (or router if it's running linux) to reject traffic unless it came from a specific IP/range of IPs.