Skip to content
Tunnelero

Reverse SSH tunnel

Most devices sit behind NAT with no public IP and no port forwarding. The tunnel feature opens a stable SSH endpoint into a device without you configuring anything on your router.

Enable a tunnel

Open a device's detail page and enable the tunnel. You can set:

  • Alias -- 3 to 24 characters, lowercase letters, digits, and hyphens (for example loja01). Leave it blank to keep the current alias or let the server derive one. If the alias you request collides with an existing one, the server appends a short suffix and returns the alias actually assigned -- always use the alias shown in the dashboard, not the one you typed.
  • Mode -- persistent keeps the tunnel open continuously; on_demand opens it only when requested.

Connect over SSH

Once the tunnel status is established, the dashboard shows a ready-to-copy command:

ssh -p 22451 [email protected]

Here pi is the device's own login user (use whatever user you log in as on that device). The connection routes through the tunnel gateway straight to the device's sshd, as if you were on its local network, so you authenticate with your own SSH key, which must already be in that user's authorized_keys on the device.

Tunnel status

  • disabled -- no tunnel has been requested for this device.
  • pending -- the tunnel was requested; waiting for the device to establish the connection.
  • established -- the SSH endpoint is live; the command above will connect.
  • down -- the tunnel was established but the device is not currently reachable (for example, it went offline).

Disable a tunnel

Disabling revokes the device's tunnel key. Revocation takes effect on the gateway's next key sync, not necessarily instantly.