SSH behind a firewall, without port forwarding

Sometimes you cannot open a port: the router is not yours, or the network has no public IP. The way around it is to let the device dial out.

Why port forwarding fails

The router belongs to a customer, a site or a landlord, and nobody there will change it for you. Or the provider gives no public IP at all; see SSH behind CGNAT. Or inbound traffic is blocked by policy, while outbound HTTPS usually still works.

Three ways to dial out

A reverse SSH tunnel: the device runs ssh -R to a server you rent. It is free if you already have the server. You keep it patched, and you restart the tunnel when it drops.

A mesh VPN, like Tailscale or WireGuard, joins the device to your network. That gives you more than a shell, but it needs a tun device or a userspace mode on the box.

A hosted relay, like RescueShell: the device holds one outbound HTTPS connection, and you open a shell from the browser or a CLI.

How RescueShell does it

The agent is one static binary and opens no port on the device. If the link drops it retries every 60 seconds, five times, then waits 30 minutes and starts over.

Your session goes to the device's own OpenSSH server, which checks an SSH key. The device keeps its own list of trusted keys, and our servers cannot add to it. From the CLI you use your own key. In the browser you paste one or use a saved one. Port forwarding through a session is off. It is a shell on the device, not a route into the network.

€0.10 a device a month, billed yearly, at least €6 a year. How it works.

Pick a reverse tunnel if

You have one or two machines and already run a server. It costs nothing more.