Run the ngrok agent on the Pi and start a TCP tunnel to port 22. The agent connects outbound to ngrok, so it works even behind NAT or carrier-grade NAT (CGNAT) where you have no public IP and can't forward ports. You then SSH to the address ngrok gives you, and it forwards the connection to the Pi.
Yes. Port forwarding requires a public IP and control of the router, which you often don't have on home, cellular, or customer networks. Because the ngrok agent dials outbound over port 443, the Pi becomes reachable without opening any inbound ports or touching the router.
Yes. ngrok gives the Pi a stable, addressable endpoint regardless of its local IP, so you don't need a static IP, dynamic DNS, or a VPN. Access is scoped to the SSH service you expose rather than the whole device or network.
The tunnel is encrypted end to end and the Pi never accepts inbound connections directly. Lock it down further with IP restrictions and mutual TLS enforced at ngrok's edge, and keep SSH key authentication on the Pi itself, so only your machines reach it.
You set up a Raspberry Pi (a home server, a camera, a sensor at a remote site) and now you want to SSH into it from somewhere else. The moment the Pi lives behind a home router, a cellular modem, or a customer’s firewall, that turns out to be the hard part.
The usual fixes are all painful. Port forwarding needs a public IP and control of the router, which you rarely have on someone else’s network. It’s a non-starter on carrier-grade NAT (CGNAT), where your ISP shares one address across many customers. Dynamic DNS breaks when the address changes. A VPN grants access to the whole network and is a chore to maintain across every site.
This guide shows a simpler path: the Pi dials outbound to ngrok, and you connect to the stable address ngrok hands back. No port forwarding, no static IP, no VPN.
How it works
The ngrok agent runs on the Pi and opens a secure, outbound connection to the ngrok cloud over port 443, the same port your browser uses for HTTPS, so it sails through almost any firewall. ngrok gives that tunnel an addressable endpoint. When you SSH to that endpoint, ngrok forwards the connection down the tunnel to sshd on the Pi. You never open an inbound port.
Step 1: Install the ngrok agent on the Pi
Raspberry Pi OS is Debian-based, so install the agent from ngrok’s apt repository. This works on both 32-bit (arm) and 64-bit (arm64) builds:
From your laptop (on any network), connect to the host and port from that forwarding line:
ssh pi@1.tcp.ngrok.io -p 23456
That’s it. You’re on the Pi.
Make the address stable
By default the tunnel gets a new address each time the agent restarts. That’s fine for a quick session and annoying for something you connect to often. Reserve a TCP address and pass it with --url so it stays the same across reboots:
ngrok tcp 22 --url tcp://<YOUR_RESERVED_ADDRESS>
Keep it running after reboot
To keep the Pi reachable without logging in, run the agent as a background service. Define the tunnel in your ngrok.yml config file, then install and start the service:
1ngrok service install --config /home/pi/.config/ngrok/ngrok.yml2ngrok service start
Restrict an SSH endpoint reachable from anywhere to just your machines. Two quick wins:
Keep SSH key authentication on, and disable password login on the Pi itself.
Add an IP restriction so only your known IPs reach the endpoint, enforced at ngrok’s edge before traffic ever gets to the Pi. Layer on mutual TLS too.
From one Pi to a fleet
Reaching a single Pi is the easy case. If you deploy many devices (sensors, controllers, or full appliances) into sites you don’t control, the same outbound-agent model scales to thousands of them, with per-device naming, credential rotation, and policy managed centrally. That’s the device gateway use case: remote device management and secure access for an entire deployed fleet, not just the Pi on your desk.
