You set up a Raspberry Pi (a home server, a camera, a sensor at a remote site) and now you want to SSH into it from somewhere else. The moment the Pi lives behind a home router, a cellular modem, or a customer’s firewall, that turns out to be the hard part.
The usual fixes are all painful. Port forwarding needs a public IP and control of the router, which you rarely have on someone else’s network. It’s a non-starter on carrier-grade NAT (CGNAT), where your ISP shares one address across many customers. Dynamic DNS breaks when the address changes. A VPN grants access to the whole network and is a chore to maintain across every site.
This guide shows a simpler path: the Pi dials outbound to ngrok, and you connect to the stable address ngrok hands back. No port forwarding, no static IP, no VPN.
The ngrok agent runs on the Pi and opens a secure, outbound connection to the ngrok cloud over port 443, the same port your browser uses for HTTPS, so it sails through almost any firewall. ngrok gives that tunnel an addressable endpoint. When you SSH to that endpoint, ngrok forwards the connection down the tunnel to sshd on the Pi. You never open an inbound port.
Raspberry Pi OS is Debian-based, so install the agent from ngrok’s apt repository. This works on both 32-bit ( arm ) and 64-bit ( arm64 ) builds:
Grab your authtoken from the ngrok dashboard and register it on the Pi:
Make sure SSH is enabled on the Pi ( sudo raspi-config → Interface Options → SSH ), then start a TCP tunnel to port 22:
ngrok prints a forwarding address that looks like this:
From your laptop (on any network), connect to the host and port from that forwarding line:
That’s it. You’re on the Pi.
By default the tunnel gets a new address each time the agent restarts. That’s fine for a quick session and annoying for something you connect to often. Reserve a TCP address and pass it with --url so it stays the same across reboots:
To keep the Pi reachable without logging in, run the agent as a background service. Define the tunnel in your ngrok.yml config file, then install and start the service:
See the SSH guide for a complete config example.
Restrict an SSH endpoint reachable from anywhere to just your machines. Two quick wins:
Reaching a single Pi is the easy case. If you deploy many devices (sensors, controllers, or full appliances) into sites you don’t control, the same outbound-agent model scales to thousands of them, with per-device naming, credential rotation, and policy managed centrally. That’s the device gateway use case : remote device management and secure access for an entire deployed fleet, not just the Pi on your desk.
Run the ngrok agent on the Pi and start a TCP tunnel to port 22. The agent connects outbound to ngrok, so it works even behind NAT or carrier-grade NAT (CGNAT) where you have no public IP and can't forward ports. You then SSH to the address ngrok gives you, and it forwards the connection to the Pi.
Yes. Port forwarding requires a public IP and control of the router, which you often don't have on home, cellular, or customer networks. Because the ngrok agent dials outbound over port 443, the Pi becomes reachable without opening any inbound ports or touching the router.
Yes. ngrok gives the Pi a stable, addressable endpoint regardless of its local IP, so you don't need a static IP, dynamic DNS, or a VPN. Access is scoped to the SSH service you expose rather than the whole device or network.
The tunnel is encrypted end to end and the Pi never accepts inbound connections directly. Lock it down further with IP restrictions and mutual TLS enforced at ngrok's edge, and keep SSH key authentication on the Pi itself, so only your machines reach it.