Accessing a host over SSH#

SSH is the classic reason to want a tunnel: a Raspberry Pi behind CGNAT, a server on a home connection, a box on a factory LAN — reachable from anywhere, with no port-forwarding and no VPN. This page walks through exposing SSH with Tollan and connecting to it comfortably.

Why a port route#

SSH is not TLS — it has its own handshake, its own encryption, and its own authentication (your keys). That has two consequences:

A hostname (SNI) route won't work: there is no TLS ClientHello for the relay to read a hostname from. Use a port route, which forwards raw TCP.
Port routes are a pure passthrough splice, so the relay moves encrypted SSH bytes it can't read — the same zero-knowledge stance as TLS passthrough. Tollan adds reachability; SSH keeps providing the security.

Set it up#

1. Get the device online. Register the device in the console and install the agent from its bundle — the Quickstart covers this. The agent machine does not have to be the SSH target itself (see step 2).

2. Add the route. On the device's page in the console, add a route:

Internal host — 127.0.0.1 if the SSH server runs on the same machine as the agent, or a LAN address like 192.168.1.50 to reach another host through the agent (forwarding mode — remember the target must be on the agent's allowlist).
Internal port — 22.
Exposure — port. The console previews the next free public port; note the assigned endpoint it shows next to the route, e.g. relay.tollan.ie:19000.

That's it — the route is live as soon as it's saved.

3. Connect.

bash

ssh -p 19000 pi@relay.tollan.ie

Replace 19000 and relay.tollan.ie with the endpoint from your console, and pi with a user that exists on the target machine. The username, keys, and host fingerprint are all the target's — Tollan never terminates or inspects the SSH session.

Make it comfortable#

Add a block to ~/.ssh/config so the tunnel detail disappears:

Host greenhouse
    HostName relay.tollan.ie
    Port 19000
    User pi

Now everything just works by alias:

bash

ssh greenhouse            # interactive shell
scp backup.tgz greenhouse:/srv/backups/
sftp greenhouse
ssh -L 8080:localhost:80 greenhouse   # local port-forward through the tunnel

Note

On first connect you'll be asked to confirm the target's host key fingerprint, exactly as with a direct connection — that check is end-to-end and is your proof you reached your machine, not something in between.

Hardening#

Keys, not passwords. The public port is reachable from the internet, so it will see scanners. Disable password login on the target (PasswordAuthentication no in sshd_config) and use keys — standard practice, doubly so here.
IP allowlist. If you connect from stable addresses, add an IP allowlist rule to the device or route. It's enforced at the relay on port routes — connections from anywhere else are closed before a single byte reaches your device.
Basic auth doesn't apply here — it's an HTTP mechanism, and this is raw TCP. SSH's own authentication is the gate (see where rules are enforced).
Off is off. The route's enable toggle takes effect at the relay immediately — a convenient kill switch when the box only needs to be reachable during maintenance windows.

Only your own devices need in?#

If the SSH client is itself a Tollan device (your laptop's agent, another server in the fleet), skip the public port entirely: put both devices in a device group and SSH to the internal name — ssh pi@mymac22.tollan.myteam.internal. Nothing is exposed to the internet at all.