One of my Debian Boxes has no GUI. How to connect to it via command line from outside (like AnyDesk, Teamviewer etc...)?

I can use SCP & SSH to access this machine while I am inside office network. But how I can access from my home? Dynamic DNS (DDNS or DynDNS) is not applicable in my setup since the network provider is not assigning a Public IP to the WAN port of the router

Public IP and Router WAN IP is different

  • Is there any static public IP address you can use? (e.g. assigned to your home router or yet another machine you have access to). Commented Jul 30, 2018 at 9:24
  • @KamilMaciorowski , Using 4G internet router with Sim Cards. Here in Qatar Internet provider is not assigning Public IP to routers WAN for 4G Networks( I think they are using proxy ).
    – Arun
    Commented Jul 30, 2018 at 15:37
  • Provider is not assigning Public IP erm... Then how do you access anything over the internet? Even if you are dialling out, there needs to be an address for data to be sent to.
    – Baldrickk
    Commented Jul 30, 2018 at 16:37
  • You should delete this question and set up a new one: How to connect to a machine across a NAT I don't control Commented Jul 30, 2018 at 20:31
  • @EugenRieck, As you said, question modified to reflect the point that it is behind NAT.
    – Arun
    Commented Jul 31, 2018 at 8:29

4 Answers 4


Update: If the hourly connection check doesn't work for you (as in an hour is too long to wait for it to re-connect), take a look at autossh. The whole script on the debian server would be replaced with a proper autossh command in cron's @reboot or similar fashion.

Reverse SSH is your friend. You need an SSH server for this to work. I will give you two approaches for this, the first assumes you can open and run an SSH server from your machine at home. I will provide a way that tries to re-connect automatically hourly so your PC at home doesn't have to be always online. Since this can be either impossible or difficult sometimes, I will add an easier and safer solution too, which requires you to have a linux VPS though. They are usually just $2/month-ish.

Solution 1 - Using just your PC at home - Assuming static IP:

Preparation on the debian server:

I'm assuming you have cron installed and running. Create a new file in /etc/cron.hourly with the following content: (don't forget to chmod +x the file!)

cstate=$(netstat -na | grep "tcp" | grep "<IP-of-home-machine>:22" | tr -s " " | cut -d " " -f 6 | head -n 1)
cdate=$(date "+%Y-%m-%d %H:%M:%S")
if [[ $cstate == "ESTABLISHED" ]] || [[ $cstate == "TIME_WAIT" ]]
    echo "[$cdate] SSH connection up. ($cstate)" >> /var/log/check-ssh-relay.log
    echo "[$cdate] SSH connection broken. ($cstate) Reconnecting..." >> /var/log/check-ssh-relay.log
    ssh -N -f -R 12122:localhost:22 <username>@<IP-of-home-machine>

This will check hourly if the connection is up and tries to re-connect if it isn't. Useful when your PC at home isn't always on. It writes log information to /var/log/check-ssh-relay.log. Authentification is done via SSH-keys so make sure you got that setup properly in advance.

On your computer at home:

Assuming you have openssh-server setup properly, all you need to do now is:

$ ssh <server-username>@localhost -p 12122

To create the SSH connection. SCP, SFTP and co. works too of course.

Solution 2 - Using another VPS as relay:

I use this solution personally. Mostly because I do not have a static IP at home.

Preparation on the debian server:

Exactly like in solution 1, except for instead of <IP-of-home-machine> you use the VPS' IP here.

Preparation on the VPS:

All you need to do here is run the following command as root user:

$ ssh -g -f -N -L root@localhost

The -g is important here to allow global inbound connections for this port-forward.

On your PC at home (or literally anywhere):

Simply connect to your VPS now using the port 13122 (as specified above):

$ ssh <username>@<VPS-IP> -p 13122
  • 1
    In a test setup, I confirmed this method is working fine for me! used only 2 commands for testing ssh -N -f -R 12122:localhost:22 <username>@<IP-of-home-machine> In Server & ssh <server-username>@localhost -p 12122 from Client Machine
    – Arun
    Commented Jul 31, 2018 at 9:18

If you don't have a GUI, all you need is a remote console - this is typically achieved with ssh which combines very good security with value added services like scp (remote file copy).

  • I modified my question with inputs from your (@EugenRieck) answer (ssh & scp suggestion,which is not applicable in my case)
    – Arun
    Commented Jul 30, 2018 at 16:10

Your problem is likely that you are sitting behind a NAT that you do not control, and so cannot set-up port forwarding.

The easiest solution to this is reverse tunnelling - you set up a ssh connection from the machine you want to control, to the machine you want to control it from (This machine needs to be accessible via ssh)

see https://unix.stackexchange.com/questions/46235/how-does-reverse-ssh-tunneling-work

  • Really need an option to choose more than 2 as answers, Here Baldrickk already has given the clue & @confetti mentioned in a much-elaborated way!!
    – Arun
    Commented Jul 31, 2018 at 9:16
  • 1
    @Arun Don't worry, his answer is better, I didn't have the time to write a guide.
    – Baldrickk
    Commented Jul 31, 2018 at 9:31

You could setup a OpenVPN server in your office (assuming you can forward the port out of your network onto the public WAN), have your non-GUI box connect to it (Like Baldrickk's answer; reverse tunneling), and then your server should be able to SSH into the non-GUI box, along with any other services running on that box.

I see a few problems with an approach like this, one of which is if your non-GUI box's client times out a connection will be impossible without SSHing into it locally (on the same network) and restarting the client.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .