Secure Shell, or SSH, is a protocol that lets you securely connect to a remote device like a Raspberry Pi or Ubuntu server over a network. By using SSH, you can access the device’s terminal from your own computer. This is ideal for those who don’t have physical access to a device or want to manage it remotely.
This article is a step-by-step guide on how to connect to a Linux-based device. We’ll discuss two scenarios. First, if your computer and your device are on the same network and second, if your device is on a different network than your computer.
SSH allows you to remotely access your device, install software, run updates, troubleshoot issues, or restart it. You can do this from your computer’s terminal or an SSH client like PuTTY.
To start, you’ll need three pieces of information.
- Your device’s local IP address
- Username for your device
- Password
Many devices come with a default username and password which you can change once you’re connected.
Use SSH to Connect on the Same Network
If you’re on the same network, you can find your device’s local IP via your router’s DHCP client list or by running the following command on the device itself.
hostname -IOnce you know your device’s local IP, username, and password, you can attempt an SSH connection by running this command in your terminal.
ssh device_username@device_IP_addressYou’ll then be prompted for the password. Once logged in you should consider changing the default login credentials.
Use SSH to Connect on a Different Network
If you’re not on the same network as your device, you’ll have to take a few additional steps before you can connect to your proxy server remotely. This can be done by either port forwarding or using a VPN. We’ll explain both methods now.
Using a VPN to Connect Remotely
A VPN creates a secure encrypted tunnel between your remote computer and the local network your proxy server is on. This makes it appear as if your device and server are on the same local network without exposing SSH directly to the internet.
Some routers support built-in VPN servers, however services like Tailscale offer convenient solutions for setting up virtual networks that let you securely access your device without complicated router configurations.
Note: This is the recommended method to remotely access your device! It is a much more secure option.
After setting up the VPN and connecting, you can SSH using the proxy server’s internal LAN IP as if it were physically on the same network.
Port Forwarding on Your Router
Port forwarding will let external traffic access a specific device on a network. This needs to be done for the router your proxy server is connected to. I would strongly advise you to avoid resorting to port forwarding unless you really know what you’re doing. This should be a last resort, as it opens your device up to the world and comes with considerable risk. To set up port forwarding you need to:
- Log into the router’s admin panel and locate the “Port Forwarding” or “Virtual Server” section.
- Forward port 22 (the default SSH port) from the router’s public IP to your device’s internal IP and port 22.
Note: Sometimes ISPs block certain ports, including port 22. If SSH isn’t working on port 22, consider using a non-standard port (for example, 2222) for the external mapping. For instance, you can forward port 2222 on your router to port 22 on your device.
- After setting this up, you can connect using your router’s public IP.
To do so you can use the following command in the terminal:
ssh username@<YOUR_ROUTER_PUBLIC_IP>If using a non-standard port:
ssh -p 2222 username@<YOUR_ROUTER_PUBLIC_IP>Even after all of this, it’s possible that your ISP uses CGNAT or another layer of NAT, which means you won’t have the real public IP address of your router. In this case, port forwarding alone won’t be enough.
If this is the case, you should reconsider using a VPN service instead of port forwarding. Alternatively you could contact your ISP to ask if they could provide a public IP address or enable a setting that grants you external access.
There are some security considerations you should take into account to keep your network safe:
- Change the default SSH credentials before opening the port. Choosing a secure password is a very important step to protect against automated attacks. Better yet, use public key authentication, which is even more secure than a strong password. Public keys are much harder to brute force than passwords and are considered a best practice.
- Consider changing the default SSH port to something non-standard.
- Regularly update device software to patch vulnerabilities.
- Regularly check your device’s SSH logs (
/var/log/auth.logon Ubuntu/Raspberry Pi or equivalent paths on other systems) for unauthorized access attempts.
Conclusion
To use SSH to connect to a Linux server can be a straightforward process requiring only a few commands. If your device is on the same network, it’s as easy as finding its local IP and typing out a simple ssh command. Even if your device is on a different network, a VPN can make connecting to your device with SSH a very safe and secure process as well.
While port forwarding is an option to facilitate SSH, it comes with a host of security concerns, as anything that requires you to open your computer up to the entire internet would.
Remember that security is just as important as accessibility — never compromise the former for the latter. Changing your default credentials and using a strong password are the bare minimum. Using public key authentication, monitoring SSH logs, and regularly updating your software are all important ways to keep your server safe.
