I recently acquired a Raspberry Pi and I'm setting it up for various things. I have a local router that the Pi is wired into along with my desktop computer. I want to be able to access the Pi from outside my local network. I have access to my personal router, so everything works within MY network, but my router is plugged into a larger network that is locked down for obvious security reasons so I cannot access my router/Pi directly.

I have a domain through Namecheap that allows me to use dynamic DNS, and I have that DDNS working with my Pi using inadyn (set up on a subdomain). I also have a VPS running Ubuntu Server 14.10 which uses that domain.

What would be the best way to enable connections to my Pi over the internet? I want access to all ports and whatnot like normal. I started configuring OpenVPN on the VPS, but I stopped to ask this question here. Is there a way to tunnel my Pi's connection through a subdomain of my VPS and access the Pi using that subdomain (again, allowing access to my ports, e.g. pi.website.com:22 for SSH or whatever), or is there a different/better way to do this?


You need to set up remote port forwarding from the server to the Raspberry Pi. Below is just a brief explanation of what that means.1

Remote port forwarding
Now comes the second part of this tutorial, which is remote port forwarding. This is again best to explain with an example.

Say that you’re developing a Rails application on your local machine, and you’d like to show it to a friend. Unfortunately your ISP didn’t provide you with a public IP address, so it’s not possible to connect to your machine directly via the internet.

Sometimes this can be solved by configuring NAT (Network Address Translation) on your router, but this doesn’t always work, and it requires you to change the configuration on your router, which isn’t always desirable. This solution also doesn’t work when you don’t have admin access on your network.

To fix this problem you need to have another computer, which is publicly accessible and have SSH access to it. It can be any server on the internet, as long as you can connect to it. We’ll tell SSH to make a tunnel that opens up a new port on the server, and connects it to a local port on your machine.

You can also look into MOSH,2 which was designed to overcome the difficulties of connecting to devices on a mobile network where the IP often changes and the device itself does not have a public address. I don't personally have any experience using it.

Assuming you can forward traffic from a specific port on your server to your Raspberry Pi box now, you can then configure a subdomain to redirect traffic to the port that is being forwarded. For example, if you are forwarding server traffic on port 8888 to your Raspberry Pi, you could set up something like this.3

NameVirtualHost *:80

<VirtualHost *>
    ServerAdmin me@mydomain.com
    ServerName dev.mydomain.com
    ProxyPreserveHost On

    # setup the proxy
    <Proxy *>
        Order allow,deny
        Allow from all
    ProxyPass / http://localhost:8888/
    ProxyPassReverse / http://localhost:8888/

Ordinarily you could set an A record to point that subdomain to the IP of your Raspberry Pi, but because this wouldn't allow you to remote ssh, I think the above example is your best bet.

  • That looks very promising, but when I try to use port 80 (so that I can access Apache on my Pi via my VPS) I get an error that states that remote port forwarding failed for listen port 80. I'm using this command: ssh -nNT -R 80:localhost:3180 username@site.com, and my password is entered correctly. I did add the GatewayPorts command to sshd_config as well. – vaindil Mar 3 '15 at 22:56
  • I found on another site that a four-part argument for -R is possible. This command allowed the connection to work, but when I try to connect to port 3180 I get a connection refused error. ssh -nNT -R serverhostname:3180:localhost:80 username@serverhostname – vaindil Mar 3 '15 at 23:06
  • 1
    Also, I happened across this which appears to be instructions for exactly what you are wanting to do. gist.github.com/padde/c3fc672a435fc71e621a – iyrin Mar 3 '15 at 23:26
  • 1
    Ah, I figured it out! I was being stupid; I accidentally added the GatewayPorts directive inside a MatchGroup directive, so it wasn't being applied to the whole server. Thank you so much for your help! I'll award the bounty when I'm able; the site is making me wait longer before I can. – vaindil Mar 4 '15 at 5:47
  • 1
    I did not have to do that--the command I'm using is ssh -f -N -R 3180:localhost:80 user@website.com and it works perfectly to forward port 3180 on my VPS to my Pi's port 80 (so I can access the web server on my Pi from my domain name at port 3180). – vaindil Mar 4 '15 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.