SSH Reverse Tunnel: Expose a Private Linux Machine Behind NAT

What is a reverse tunnel?

A reverse SSH tunnel lets a machine behind NAT or a firewall reach out to a public server and ask that server to listen on a port. The public server then forwards traffic back to the private machine.

This is useful when:

  • your home server is behind NAT
  • your office laptop cannot accept inbound connections
  • you need temporary remote access without opening firewall rules

Why this works

The private machine creates an outbound SSH connection to a public host. The -R option tells SSH to forward a port on the public server to a target on the private side.

The important part is that the connection is initiated from inside the private network. NAT usually blocks incoming traffic, but outbound SSH is allowed.

Example

Run this from the machine behind NAT:

ssh -N -T -R 0.0.0.0:2222:localhost:22 user@vps.example.com

This means:

  • vps.example.com listens on port 2222
  • any connection to that port is forwarded to localhost:22 on the private machine
  • -N keeps it as a tunnel only, with no shell
  • -T disables pseudo-terminal allocation

From another Linux machine, you can test it like this:

ssh -p 2222 user@vps.example.com

That login is actually reaching the private machine’s SSH daemon on port 22.

Seeing the flow

Private machine (behind NAT)
    └── ssh -R 2222:localhost:22 ... vps.example.com
            │
            └──────────────> Public VPS
                                │
                                └── listens on 2222
                                      └── forwards to private machine:22

A more explicit version:

ssh -N -T \
  -R 0.0.0.0:2222:192.168.1.50:22 \
  user@vps.example.com

Use this when the final target is not on localhost, but on another internal IP.

Keep it practical

1. Restrict access

Only bind to localhost if you do not need public access:

ssh -N -T -R 127.0.0.1:2222:localhost:22 user@vps.example.com

2. Use a watchdog

A reverse tunnel can drop. autossh is better for long-lived setups:

autossh -M 20000 -N -T -R 0.0.0.0:2222:localhost:22 user@vps.example.com

3. Check the listening port

On the VPS:

ss -tulpn | grep 2222

4. Limit risk

  • use SSH keys, not passwords
  • restrict allowed users
  • keep the tunnel on a non-standard port
  • do not expose internal services unnecessarily

When to use it

  • temporary access to a home lab
  • admin access to a device behind NAT
  • connecting to a private service without opening firewall ports

For simple setups, a reverse SSH tunnel is one of the fastest and most reliable tools available.