ThisCalculator

Everyday

SSH Into Your Home NAS or Server From LAN or Anywhere

Updated · Standard formula, shown below

SSH Into Your Home NAS or Server From LAN or Anywhere

This guide shows you how to securely connect to your home NAS or server using SSH (Secure Shell), both from devices on your local network and from anywhere on the internet. You’ll learn the essential commands, how to set up port forwarding, and how to keep your connection safe. No prior SSH experience is needed, but you should have basic familiarity with your router’s settings and your NAS’s web interface.

What You’ll Need

  • A home NAS or server that supports SSH (most do, such as Synology, QNAP, TrueNAS, or any Linux machine).
  • The IP address of your NAS on your local network (e.g., 192.168.1.100).
  • A username and password (or SSH key) for that device.
  • An SSH client on the device you’re connecting from: Windows 10/11 has built-in OpenSSH; macOS and Linux have it preinstalled.
  • For remote access: a router that allows port forwarding, and a way to know your public IP (or a dynamic DNS service).

Step-by-Step

  1. Enable SSH on your NAS or server. Log into your NAS’s web interface, find the terminal or SSH settings (often under “Control Panel� or “Services�), and enable SSH. Note the port number (default is 22). On Linux, you may need to install and start the OpenSSH server: sudo apt install openssh-server (Debian/Ubuntu) or sudo dnf install openssh-server (Fedora).
  2. Find your NAS’s local IP address. On the NAS, check its network settings; it’s usually something like 192.168.1.x or 10.0.0.x. You can also find it in your router’s DHCP client list.
  3. Test SSH from your local network. Open a terminal (Command Prompt, PowerShell, or terminal app). Use the command: ssh username@192.168.1.100 (replace with your actual username and IP). If the port is not 22, add -p portnumber. You’ll be prompted for the password. If you see the remote shell prompt, local SSH works.
  4. Set up port forwarding on your router for remote access. Log into your router’s admin page (often at 192.168.1.1). Find “Port Forwarding� or “Virtual Server�. Create a rule: external port (choose a high number like 2222 to reduce bot scans) → internal IP of your NAS → internal port 22 (or your custom SSH port). Save the rule.
  5. Determine your public IP or set up dynamic DNS. Visit a site like whatismyip.com from your home network to see your public IP. Since most ISPs change this IP periodically, set up a dynamic DNS (DDNS) hostname—many routers and NAS devices have built-in DDNS clients (e.g., with no-ip.com or DuckDNS).
  6. Connect from anywhere. From a remote device, use: ssh -p 2222 username@your-public-ip-or-ddns-hostname. If you used a different external port, adjust the -p flag. You should see the same login prompt as locally.
  7. Harden your setup (strongly recommended). Change the default SSH port on the NAS to a non-standard one (e.g., 2222) in the SSH settings. Disable password login and use SSH keys instead. Create a dedicated SSH user with limited permissions, and consider installing fail2ban to block brute-force attacks.

Common Mistakes

  • Using the wrong IP address. Make sure you’re using the NAS’s local IP for LAN connections and your public IP (or DDNS hostname) for remote connections.
  • Forgetting the port number. If you changed the SSH port on the NAS, you must specify it with -p every time. Port forwarding external port must match the -p value.
  • Port forwarding to the wrong internal IP. If your NAS’s IP changes (DHCP), the forward breaks. Set a static IP or DHCP reservation for the NAS.
  • Leaving the default port 22 exposed. Bots constantly scan for SSH on port 22; using a non-standard port reduces automated attacks.
  • Not testing locally first. If local SSH fails, remote SSH will never work. Always verify LAN connectivity before configuring port forwarding.

Tips

  • Use SSH keys instead of passwords: generate a key pair with ssh-keygen, then copy the public key to the NAS using ssh-copy-id (Linux/macOS) or manually. This is more secure and convenient.
  • Set up a VPN (like WireGuard or OpenVPN) on your NAS or router instead of exposing SSH directly. This adds a layer of encryption and access control.
  • If your router supports UPnP, you can sometimes forward ports automatically, but manual configuration is more reliable and secure.
  • Use a dynamic DNS service even if your IP rarely changes—it saves you from checking your IP every time.
  • Consider using a reverse SSH tunnel (e.g., using a cloud server) if your ISP uses CGNAT, which prevents port forwarding.

Troubleshooting

  • Connection refused or timeout. Check that SSH is enabled on the NAS, the port is correct, and the NAS’s firewall allows incoming SSH (both local and from the internet). For remote, verify the port forwarding rule is active and points to the right IP.
  • Password prompt doesn’t appear. You might be using the wrong username or the NAS’s SSH is configured to reject password auth. Try ssh -v to see verbose output.
  • Remote works but local doesn’t. This is unusual—check if your router has “NAT loopbackâ€� disabled. If so, you need to use the local IP when on the LAN, or enable NAT loopback.
  • Can’t connect from outside but local works. Check your public IP—it might have changed. Also, some ISPs block inbound ports; try a different external port. Use a port checker tool to see if the port is open.
  • SSH key not working. Ensure the public key is in the correct file (~/.ssh/authorized_keys) on the NAS, with correct permissions (chmod 700 for .ssh, 600 for authorized_keys). Also, check that the NAS’s SSH config allows key auth.
  • Slow connection. This can happen with high-latency links; you can use ssh -C to enable compression, though it’s rarely needed.

Frequently Asked Questions

Is SSH secure enough to expose to the internet?

SSH itself is encrypted, but exposing it to the internet increases risk. Using keys, a non-standard port, and fail2ban makes it reasonably safe. A VPN is even safer.

Can I use SSH on my phone?

Yes, there are SSH client apps for iOS and Android, such as Termius or JuiceSSH. They work the same way as desktop clients.

What is the default SSH port?

Port 22. You can change it in the SSH configuration file (/etc/ssh/sshd_config on Linux) or in your NAS’s settings.

Do I need a static IP for remote access?

No, but it helps. If your IP changes, you’ll need to update your port forward or use a dynamic DNS service that tracks your current IP.

Can I SSH into my NAS from a different network without port forwarding?

Yes, if you use a VPN or a reverse SSH tunnel. These methods don’t require opening ports on your router.

Why do I get “Host key verification failed�?

This happens when the remote host’s key changes (e.g., after reinstalling). You can remove the old key from your local known_hosts file with ssh-keygen -R hostname, then reconnect.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.