How to SSH into your home server from your phone, without opening a port

The usual way to reach SSH from outside is to forward port 22 on your router to the server, which puts its sign-in on the internet for anyone to try. RemoteAccessApp works the other way round. A PC at home running the RemoteAccessApp Agent keeps an outgoing connection to our relay, and routers allow outgoing connections. When you open the server on the website and choose Through my PC, the website reaches that PC through the relay, and the PC opens the SSH connection on your home network, just as if you were sitting in front of it.

Nothing changes on your router, and it doesn't matter if your address changes or your provider shares one address between customers. More on that in remote desktop without port forwarding and remote access behind CGNAT, 4G/5G and Starlink.

What the PC at home needs:

• To be one of your own Windows or Linux PCs, on the same network as the server, with RemoteAccessApp installed and up to date.
• To be switched on and online, with remote control allowed.
• Someone there to click Allow, unless it has unattended access on or already remembers your browser. If nobody will be home, turn on unattended access before you leave; it can only be switched on at the PC itself. See setting up unattended access.

1. 1

   Step 1: Save the server

   If you saved it on the Connections page of the app while signed in, it's on the website already. Otherwise, on the website go to SSH & servers and choose Add host: its local address (such as 192.168.1.20), port 22 and the user name. Under Sign in with, pick Password, SSH key or Ask every time.
2. 2

   Step 2: Open it on your phone

   Sign in at remoteaccessapp.com in your phone's browser, open SSH & servers and tap Open terminal under the server.
3. 3

   Step 3: Check how it connects

   The first time, the sign-in card shows the route. For a local address and one PC at home, it reads Connects through and the PC's name. With several PCs it asks How should RemoteAccessApp reach it?, and you pick the one on that network. A server with a public address uses Directly from the RemoteAccessApp server instead, and Pro adds the server tunnel you may already use in the Windows app. The choice is remembered once it works; change it later under How to connect in the terminal's menu.
4. 4

   Step 4: Trust the server's key

   Before any password or key is sent, you're shown the server's key fingerprint. Compare it with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub run on the server, then tap Trust and connect.

On the free plan, type the password when the terminal asks. The sign-in card is an ordinary sign-in form, so your phone's password manager can save the server's password and fill it in next time. If your private key file is on the phone, Use a key file just this once signs in with it and doesn't keep it.

Saved passwords and keys Pro

With Pro, the card can use your end-to-end encrypted vault instead: tick Save to my encrypted vault, or tap Use my saved key (unlock vault). Keys come from the SSH keys tab on the website, where you can paste one or generate a new one in the browser, or from the Windows app, where a key ticked Also use this key on the website (end-to-end encrypted) comes across. Already signing in with a password? Edit the host on the website and choose Install one of your keys on this server…: it signs in with the password once, adds the key's public half to ~/.ssh/authorized_keys, tests it, and offers Switch to key sign-in. You unlock the vault once for a time you choose (30 minutes unless you change it), not on every connection.

Turn it sideways

Landscape gives you more columns, and the key bar fits on one line. With the keyboard up on a short landscape screen, the header gets out of the way so the terminal and keys have the room. Held upright, the key bar has two rows: Esc, Tab, Ctrl, Alt and the arrows stay put, and the rest scroll sideways.

The key bar

It sits just above the keyboard with the keys a phone doesn't have. Ctrl and Alt are sticky: tap Ctrl, then a letter, or tap it twice to lock it on. Arrows repeat while you hold them. There are ready-made ^C, ^D, ^Z, ^L and ^R keys, Home, End, PgUp and PgDn, symbols like | and ~, and F1 to F12 for htop. The first key shows or hides the phone's keyboard, and Choose keys at the end lets you hide, add and reorder keys, saved on that phone.

Copy, paste and text size

Long-press to select a word and drag to select more; a bar offers Copy, All and Paste. Paste is on the key bar too. If the browser won't let the page read the clipboard, a Paste into the terminal box opens: long-press it, choose Paste, then Send. Pinch with two fingers to change the text size, or use Text size in the More menu, and swipe with one finger to scroll back. The terminal also asks your keyboard not to autocorrect or capitalise what you type.

Quick checks

Most phone sessions are a look around, not a rebuild:

uptime
df -h
free -h
docker ps
systemctl status nginx --no-pager
journalctl -u nginx -n 50 --no-pager

Swap in your own service names. Use journalctl -u nginx -f to follow a log live, and the ^C key to stop it. For checks you run often, save them once as a script: Scripts and history in the terminal's header has your saved scripts, synced with the app, and Run sends every line. It also keeps the commands you typed in that browser, without passwords typed at prompts.

A phone's connection can drop at the wrong moment. Run anything long, like an upgrade, inside tmux or screen on the server so it carries on, then tap Reconnect and run tmux attach.

It helps to know how the pieces fit. The SSH client runs on the RemoteAccessApp website's server, and your phone shows the terminal over an encrypted connection to it. When you connect through your PC, the SSH session is encrypted all the way from there to your home server: the relay and your PC at home pass on encrypted bytes they can't read.

• Your password or key is used only to sign in, after the server's key checks out. The website holds it in memory for that sign-in and never stores or logs it.
• The server's key is checked on every connection. If it ever changes, the terminal stops with a warning before anything is sent, and replaces the trusted key only when you confirm it.
• Saved passwords and keys (Pro) are encrypted in your browser with a key made from your account password, so our server stores only data it can't read.
• Through my PC works only with PCs you own, and the PC shows who is connecting to which server while the connection is open.
• Turn on two-step verification for your RemoteAccessApp account, and sign in to your servers with keys where you can.

The security page covers the rest.

The browser terminal is for SSH. Back at a computer, RemoteAccessApp for Windows does more with the same saved hosts: SFTP and FTP file managers with drag and drop, terminals side by side with one command sent to every open tab, a live dashboard of each server's CPU, memory, disk and network, a disk usage map, Proxmox VMs you can start and stop, and one script run on many hosts at once. The Linux app has SSH and SFTP tabs too. See the SSH and SFTP client and homelab management pages.

And when the job needs a screen, like a web interface that only answers on your home network, open the PC at home from your phone's browser and use it there. The guide to controlling your PC from a phone has the touch controls.