Public SSH Relay

pipa.sh lets you expose an SSH server from behind NAT with a reverse SSH connection, then reach it through standard OpenSSH ProxyJump.

You do not have to memorize the flow. pipa.sh prints the next step when you register a host, when you publish it, and when a new client lands on the service.

View the repo See quick start

Quick Start

Three steps

The relay has one job: connect a public SSH client to a live SSH server running somewhere else.

1

SSH into pipa.sh to get a hostname

Start by registering with the relay. It prints a random hostname under *.pipa.sh and the exact publish command for the next step. 

ssh pipa.sh

Want your own hostname instead of the generated one? Point a custom domain at the published *.pipa.sh name with a CNAME record and the relay will follow it.

2

Run the SSH forward command

Execute the printed reverse SSH command on the machine behind NAT that already has the SSH server you want to expose. 

ssh -R 22:localhost:22 <token>@pipa.sh

You can keep this alive with a user-level systemd unit instead of running it manually. See the example units in the repo.

3

Connect as a client

After the publisher is live, connect to the hostname like any other SSH destination and let OpenSSH route through pipa.sh. 

ssh <hostname>.pipa.sh

On a client's first direct connection, the service prints the instructions for setting up ProxyJump.