My ISP gives me a 192.168.* IP to my home router. Only the main company router in the building gets a real IPv4 IP but all of the tenants in the building share that. They don't do IP forwarding so I can't request port 22 to be forwarded just to me or anything like that.

Using Tor, I can open a route to the Tor network and ssh in from the outside. However, it is very laggy as you can image. Similarly, my Synology NAS opens a route to a remote server at Synology and I can connect to it remotely.

I would like to know what this transport system is called and how I can use it to connect my home machine to a VPS server that I already lease (aka my bastion host) so that I can ssh in remotely, via the bastion host, without needing to go through Tor. I love Tor, but the lag over ssh makes me crazy.

  • Do you want to log into your VPS and run an ssh command there, or do you want to be able to run an ssh command from any machine on the internet? You are looking to create a tunnel from your home machine. The most well known is probably ngrok but wireguard is probably the best for a permanent setup and just using ssh -R for an instant setup.
    – icarus
    Jan 3, 2021 at 17:05

1 Answer 1


I've did the exact same thing recently to connect to IoT devices connected on the Internet with mobile network and therefore under NAT.

My solution is based on a micro-instance on Google Cloud. Its IP must be permanent, let's call it server_ip. No firewall rules seem needed.

On your local device, that one that you'd like to connect remotely, run:

ssh -N -R 5757:localhost:22 <server_ip>

where 5757 is the listening port that will be opened on the server (it could be anything but grater than 1023). This instruct the server to

On the end-device, e.g. on your laptop when you're away from home, run:

ssh -J <server_ip> -p 5757 localhost

this will connect you via jump host, routing the ssh connection directly to the opened connection from your home device.

To make everything more secure and smoother, I suggest you to use SSH key-based authentications, both in the server and in your home device. If you need further assistance, please comment.

As a final note, the first command (ssh -N -R 5757:localhost:22 <server_ip>) must not be quit, therefore you have to run it with nohup or through a service. The latter solution is that one that I prefer, here is my service file:

Description=Reverse SSH to GCL on port 5757

ExecStart=/usr/bin/ssh -N -R 5757:localhost:22 <server_ip>

  • Thank you very much. I tested this and it works!
    – elmerjfudd
    Jan 4, 2021 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.