Usage

Install sshforward.net on the machine you want to reach. After that you can open it by name from anywhere: in your browser, as a remote desktop, or over SSH. No port forwarding, static IP or firewall changes needed.

Get started

Create a free account

Install on the machine you want to reach

Download the installer and run it on that machine:

Windows: Run the installer.
macOS: Open the .pkg.
Linux: Extract the tarball and run sudo ./install.sh.

Open the Tray Application (sshforward.net) and choose Enable Service.

The service will now run persistently in the background and automatically start on reboots.

Alternatively from the terminal

sudo sshforward.net enable-service --detect-services

If you signed up with Google, run sshforward.net login --with-google first.

Connect

The machine now appears under Machines on the website. From any other device, connect in one of these ways:

Browser: Open the machine and click Connect (SSH) for a terminal or Connect (RDX) for the desktop.
Remote desktop: sshforward.net rdx myserver.alice
Terminal: sshforward.net connect myserver.alice or ssh myserver.alice -J sshforward.net (Jump Host)

The sshforward.net commands need the client on your device as well.

Machine Connections — Connection overview

Remote desktop with RDX

RDX shows the screen of your remote machine in the browser or in the built-in viewer. You log in with the remote machine's own account.

RDX requires either RDP or VNC to be running. Turn one of them on in the system settings:

Windows: Remote Desktop
Ubuntu, GNOME: Remote Login or Desktop Sharing
macOS: Screen Sharing
Other systems: Install a VNC server.

You can set these when enabling the service over the Desktop Application or in the terminal

sshforward.net run --services ssh,rdx,rdp

and then connect to a specific service

sshforward.net connect myserver.alice --service rdx

Copy files

sshforward.net cp copies files to or from a machine, with the same arguments as scp. Prefix the remote side with the machine name:

sshforward.net cp ~/notes.txt myserver.alice:~/
sshforward.net cp -r myserver.alice:~/photos ./

Code editors and other SSH tools

You can also use it in combination with IDEs like VS Code or IntelliJ for remote development. Add an entry to ~/.ssh/config for your handle:

Host *.alice
    ProxyCommand sshforward.net connect-stream %h

Then connect to myserver.alice as to any other SSH host.

For VS Code you can also directly pass to Remote-SSH: Add New SSH Host

ssh -o ProxyCommand="sshforward.net connect-stream %h" myserver.alice

and connect with Remote-SSH: Connect to SSH Host.

On the machine to share, run:

sshforward.net adhoc -e

It prints a name. The other person connects with sshforward.net connect <name>. The session ends after 2 hours.

Who can connect

Secure Connect is turned on by default and only allows connection attempts from clients that are logged into your account. You can turn it off in the machine's page, furthermore you can adjust the default in Settings.

With Secure Connect, plain ssh needs an SSH key and the authenticated jump host:

ssh myserver.alice -J auth@sshforward.net

How it works

The installed service on your machine opens an outgoing, encrypted connection to sshforward.net over port 443, the port used for HTTPS. It registers the machine under its name and reconnects on its own after network changes or reboots. No incoming ports, static IP or firewall changes are needed.
When you connect, your device reaches sshforward.net the same way, and the server links the two sides.
The session starts right away through sshforward.net. In the background, both sides try to reach each other directly: inside your local network, or across the internet by briefly meeting in the middle through their internet routers. The first direct path that works takes over the running session without interruption, making it faster. If none works, traffic keeps flowing through sshforward.net.
Every session is end-to-end encrypted between your device and the machine: SSH and file copy by SSH itself, remote desktops by an additional encryption layer keyed to the machine. sshforward.net only passes the encrypted data on and cannot read it.
Each machine has its own fingerprint. On the first connection you confirm it, and you are warned if it changes.

Checking a fingerprint

Compare the fingerprint in the prompt with the one on the machine: in the Desktop Application under Status..., or in the output of sshforward.net status.

More options

Run without installing

sshforward.net run

The machine is reachable as long as this runs.

Choose services and ports

sshforward.net run --services ssh,vnc=localhost:5901,rdp

To use your own VNC or RDP client, run sshforward.net connect myserver.alice --service vnc and point it at localhost:6900 (RDP: localhost:6389).

No SSH server on the machine

sshforward.net run -e

-e starts a built-in SSH and SFTP server and prints its password.

Docker

sudo docker run -v sshforward-config:/config --network=host -it --rm docker.sshforward.net/client

Append adhoc to use it without an account.

Updates and metrics

The service updates itself. To stop sending CPU, memory and disk metrics:

sudo sshforward.net --no-metrics enable-service

Stop or uninstall

Stop: sudo sshforward.net disable-service
Windows: Uninstall it under installed apps.
macOS: sudo sshforward.net uninstall-pkg
Linux: sudo /opt/sshforward/uninstall.sh

Troubleshooting

Linux: the Desktop Application cannot reach the service

Add yourself to the sshforward group, then log out and back in:

sudo usermod -aG sshforward $USER

Connecting to RealVNC Server fails

Switch RealVNC to plain VNC authentication and restart it:

Authentication=VncAuth
Encryption=PreferOff

"encrypted, but not end-to-end encrypted"

Update the client on the remote machine.

An unknown machine is refused in a script

Pass --accept-unknown to trust machines seen for the first time.

How does sshforward compare to other tools?

More information