How do I SSH into a machine behind my router without port forwarding?
Port 22 on the public internet is a liability. Here is how to reach the machine anyway.
What you are running into
Every guide says the same thing: log into the router, forward port 22 to the server, done. Within a day the auth log fills with password attempts from the whole internet. You change the port, install fail2ban, disable password auth, and now you are maintaining a hardened public service just to reach your own box.
Sometimes forwarding is not even possible: you are on a shared connection, a landlord's router, a mobile hotspot, or an ISP that puts you behind carrier-grade NAT.
How SSH Guru handles it
Outbound only
The bridge board dials out to SSH Guru and keeps the connection open. Your router sees ordinary outgoing traffic. Nothing listens on your network.
Deny by default
The board only dials the addresses and ports on its allow list. Everything else on your LAN stays unreachable, even from your own account.
Your keys stay yours
SSH runs inside the browser, compiled to WebAssembly. Credentials are encrypted with your passphrase before they are stored. The service holds ciphertext it cannot open.
What to do, step by step
- Sign up and set a vault passphrase
Free account. The passphrase protects your keys in the browser.
- Get an ESP32-S3 board
About $5. Store links are in the wizard. Any variant with native USB works.
- Run the bridge wizard
Bridges, New bridge, plug the board in over USB (Chrome or Edge; flashing needs Web Serial). The browser flashes the firmware and writes your Wi-Fi details and allow list directly to the board.
- Allow only the target
One line: the server's LAN address and port 22. Add a subnet later if you need more.
- Power the board on the LAN
Plug it into any USB charger near the router. It shows online in the app when connected.
- Connect
Add the server with its LAN address, pick the bridge as the route, and open a session from any browser.
Questions
Is this a VPN?
No. Nothing is installed on your devices or on the server, and only the addresses on the board's allow list are reachable, only over SSH Guru, only from your account.
What does the relay see?
Your IP, the destination host and port, timing and volume. Not the content: the SSH encryption is between your browser and the server.
What happens if SSH Guru goes down?
Bridged sessions need the relay, so they drop. Your server is untouched, nothing on it depends on us, and your keys are still in your browser vault.