ngrok can create a temporary SSH endpoint for a Mac, Linux machine, or Windows PC without a public IP. Use ngrok for temporary access; prefer Tailscale for regular access.
Before You Start
- SSH already works locally.
- ngrok is installed and its Authtoken is configured.
- The ngrok account supports TCP Endpoints.
Some plans require a valid payment method for TCP Endpoints. Check the current status in the ngrok Dashboard.
Install and Sign In
macOS:
brew install ngrok
ngrok config add-authtoken YOUR_NGROK_AUTHTOKEN
Windows PowerShell:
ngrok config add-authtoken YOUR_NGROK_AUTHTOKEN
Start SSH Forwarding
On the host you want to reach, run:
ngrok tcp 22
ngrok displays an address similar to:
Forwarding tcp://0.tcp.ngrok.io:12345 -> localhost:22
Add the Host in Redock
Host: 0.tcp.ngrok.io
Port: 12345
Username: <Remote Username>
Connection Mode: SSH
Auth: SSH Key
Enter only the hostname in Host; do not include tcp://.
Use a Stable Address (Optional)
Random TCP addresses may change after a restart. For a stable address, create a TCP Address in the ngrok Dashboard and start the endpoint with the assigned address:
ngrok tcp 22 --url tcp://<reserved-address>
Security
- Prefer an SSH Key; do not expose a weak password.
- Stop ngrok when access is no longer needed.
- Mosh requires UDP and does not work through a standard ngrok TCP tunnel.
Common Issues
- Cannot connect: Confirm that ngrok is running and the Host and Port match the current forwarding address.
- Authentication failed: Check the Username, Password, or SSH Key.
- Address changed: Update the Redock Host or use a stable TCP Address.
- Cannot create a TCP Endpoint: Check the plan, payment requirements, and TCP Endpoint access.