How to SSH into your computer from outside your network without port forwarding

Yes, you can SSH into your computer from outside your network without port forwarding. The trick is the same in every method: the computer makes an outbound connection to something both sides can reach, and SSH comes back in over it. A mesh VPN such as Tailscale does this with the least effort, and it is what we would use from a phone.

The other real options are Cloudflare Tunnel and a reverse SSH tunnel through a VPS you own. All three work behind carrier-grade NAT, where port forwarding is not possible at all, and for a Mac, a Linux box or a Raspberry Pi alike.

Why SSH from outside fails by default

Your computer has a private address such as 192.168.1.20 that only means something inside your home. The router shares one public address between all your devices (NAT), and its firewall lets a packet in only if it matches a connection that started from inside. An SSH connection arriving from the internet matches nothing, so it is dropped.

Port forwarding is a manual exception: anything arriving on port 22 goes to this machine. Some ISPs add a second layer, carrier-grade NAT (CGNAT), where your router itself sits behind the provider's NAT with no public address. You cannot configure the ISP's equipment, so port forwarding does nothing. A router WAN address in 100.64.0.0/10, the range reserved for CGNAT, is the giveaway.

Why not just open port 22

It works, if you have a public address, and it puts your login prompt in front of the whole internet. A study at the 2025 ACM Internet Measurement Conference ran 221 honeypots for 33 months and recorded more than 546 million SSH sessions from over 850,000 addresses; in 258 million of them the client tried to log in and failed.

If you forward the port anyway, make guessing pointless. Keys only, set in /etc/ssh/sshd_config:

PasswordAuthentication no
KbdInteractiveAuthentication no

Both default to yes in OpenSSH. Restart sshd and check that key login still works. The same study notes that disabling password authentication effectively mitigates these attacks. It does not hide you; not being reachable at all is stronger.

The options side by side

Option	You install	Cost	Exposed to the internet	From a phone
Mesh VPN (Tailscale)	Tailscale on the computer and the phone	Free Personal plan	Nothing	Good: iOS and Android apps, any SSH app on top
Cloudflare Tunnel	cloudflared on the computer, a domain on Cloudflare, and cloudflared or a browser on the client	Free plan, plus the domain	A public hostname, behind a Cloudflare Access login if you add one	Browser terminal, or Cloudflare's own device client
Reverse SSH tunnel	Nothing new at home; a VPS running sshd	The VPS	The VPS's SSH port	Needs an SSH app with jump host support
Port forwarding	Nothing	Free	Your SSH port, to everyone	Any SSH app; impossible behind CGNAT

Mesh VPN: Tailscale, ZeroTier or WireGuard

A mesh VPN gives each of your devices an address on a private network only they can join. Tailscale works through the NAT on both sides to connect devices directly, and falls back to its relay servers when that fails, which is how it copes with CGNAT. Either way the traffic is end-to-end encrypted with WireGuard, and nothing is opened on your router.

Install it on the computer and the phone, sign in to the same account, and SSH to the computer's Tailscale address or name. The Personal plan is free for up to 6 users with unlimited user devices (checked 2 October 2026). Step by step: Tailscale SSH from iPhone or Android.

ZeroTier is the closest alternative: create a network, install the client on each device, join with the network ID and authorise each device. It supports iOS and Android; check its pricing page for current plan limits. Plain WireGuard has official iOS and Android apps and no third party in the middle, but you write every device's configuration yourself and, as Tailscale's comparison puts it, you must open a hole in your firewall or configure port forwarding. Behind CGNAT that means a server elsewhere.

Cloudflare Tunnel

cloudflared on your computer makes outbound-only connections to Cloudflare, and you publish SSH as a hostname such as ssh.example.com pointing at localhost:22. That needs a domain active on Cloudflare. Add a Cloudflare Access application in front so only you get through; the Access free plan is listed at $0 for teams under 50 users.

The catch is the client. Cloudflare documents these ways in:

cloudflared on the client too, set as an SSH ProxyCommand (cloudflared access ssh --hostname %h). It opens a browser to log you in, then connects. Fine on a laptop; we know of no phone SSH app that can run it.
A browser-rendered terminal. After you log in, Access draws a terminal in the browser. It works on a phone with nothing installed, but you give up your SSH app, its keys and its key bar.
The Cloudflare One Client (Cloudflare One Agent on iOS and Android), which reaches the computer at a private address, like a VPN, at the price of more setup.

Reverse SSH tunnel through a VPS

If you already rent a VPS, plain OpenSSH is enough. From the home computer, connect out to the VPS and ask it to forward one of its ports back to your SSH server:

ssh -N -R 2222:localhost:22 you@vps.example.com

Port 2222 on the VPS now leads to port 22 at home. By default it is bound to the VPS's loopback address, so it is not public. From outside, hop through the VPS:

ssh -J you@vps.example.com -p 2222 homeuser@localhost

The tunnel has to stay up unattended. autossh restarts ssh when it dies; on Linux a systemd unit does the same:

[Unit]
Description=Reverse SSH tunnel
After=network-online.target
Wants=network-online.target

[Service]
User=homeuser
ExecStart=/usr/bin/ssh -N -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes -R 2222:localhost:22 you@vps.example.com
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

Run the manual command once first so the VPS's host key is accepted, save the unit as /etc/systemd/system/reverse-tunnel.service, then run sudo systemctl enable --now reverse-tunnel. It needs a key without a passphrase, so use a dedicated key and a VPS user that can do nothing else. The downsides: you maintain a public server whose SSH port faces the same scanners, and on a phone you need an app that supports jump hosts. GatewayPorts on the VPS can make port 2222 public and avoid the jump, but that puts your home SSH back on the internet.

What about Tailscale Funnel?

Funnel publishes a service on your machine to the public internet, so it looks like a fit. It is not. Per Tailscale's docs it listens only on ports 443, 8443 and 10000 and only works over TLS-encrypted connections. The command has TCP forwarders (--tcp and --tls-terminated-tcp), but SSH is not TLS, so you would have to wrap it on the client, and the result would be a public SSH endpoint again. With Tailscale installed anyway, connect over the tailnet.

Which to pick for a phone

A mesh VPN. It has an app on both phone platforms, you keep whichever SSH app you like with its own keys, nothing is public, it works behind CGNAT, and personal use is free. Cloudflare Tunnel wins when you want browser access with no client. The reverse tunnel suits people who already run a VPS.

Whichever you pick, the computer must be awake, and long-running work belongs in tmux or Herdr so a dropped connection does not kill it. Melta, our phone app for coding agents (coming soon), connects over plain SSH, and its setup command can install Tailscale on the computer for exactly this reason.

Common questions

Can you SSH without port forwarding? Yes. A mesh VPN, Cloudflare Tunnel or a reverse SSH tunnel all work because the computer connects outward first.

How do I SSH behind NAT or CGNAT without port forwarding? Use Tailscale or another mesh VPN on both devices. Behind CGNAT, port forwarding cannot work at all.

How do I SSH into my Mac from outside my network? Turn on Remote Login (System Settings › General › Sharing), install Tailscale on the Mac and on the device you connect from, and SSH to the Mac's Tailscale address.

Is forwarding port 22 safe? With keys only and passwords disabled, guessing fails. You are still scanned constantly and rely on sshd having no exploitable bug.