SSH to a server behind NAT
Most machines worth managing are not directly reachable: a home lab behind a router, an office box behind corporate NAT, a Raspberry Pi on a mobile connection, a customer server inside a network you do not control. The usual answers are port forwarding, a static IP or a VPN. There is a simpler one.
Why the usual answers hurt
Port forwarding means opening an inbound path to a machine and keeping it patched, which puts an SSH daemon in front of the internet. A static IP is an extra cost and is often simply unavailable on residential or mobile connections — and behind carrier-grade NAT, forwarding a port is not possible at all. A VPN works but is infrastructure of its own to deploy, secure and maintain for every network you need to reach into.
Let the machine dial out instead
Firewalls and NAT block inbound connections; they almost always allow outbound ones. The connector agent uses that. You install it on the target machine and claim the machine with a one-time enrollment token. The agent opens an outbound connection to NebulaSSH and holds it, and your browser session rides back down that path.
Nothing is forwarded, no inbound port is exposed, and the machine works the same on a residential line, a mobile connection or a corporate network.
- No port forwarding and no router configuration
- No static IP — CGNAT and mobile connections are fine
- No VPN to deploy or maintain
- Token-based enrollment, so nothing inbound is ever opened
- Terminal, SFTP file transfer and remote desktop over the same path
Agents for the machines you actually have
Connector agents are available for Windows x64, Windows ARM64 and Windows 7, Linux x64 and ARM64, and Android. Install one per machine, enroll it once, and it appears in your dashboard alongside your directly reachable hosts.
Common questions
Do I need to forward a port on my router?
No. The agent connects outward from the machine, so there is nothing to forward and no inbound port to expose.
Does this work behind carrier-grade NAT?
Yes. CGNAT blocks inbound connections and makes port forwarding impossible, but outbound connections still work, which is all the agent needs.
Is this a VPN?
No. There is no virtual network and no client software on the machine you are working from — the session is delivered to your browser, and only the machines you enroll are reachable.
Which systems can run the connector agent?
Windows x64, Windows ARM64 and Windows 7, Linux x64 and ARM64, and Android.
What if the machine reboots or loses its connection?
The agent re-establishes its outbound connection on its own and the machine reappears in the dashboard.
Try it on a machine you are sitting at
Open a browser, sign in, add a server. Nothing to install — and nothing left behind if the machine is not yours.