FAQ
Common questions about NoPorts
How is SSH No Ports different from Tailscale and ngrok?
Everything is in your control. There are no Web Interfaces or centralized control by us, as we never want to be an attack surface for your infrastructure. SSH No ports does not connect "networks," but provides on demand encrypted TCP connectivity to existing SSH daemons.
SSH No Ports is focused on providing end-to-end encrypted and authenticated access to a remote ssh daemon, bound to localhost.
SSH No Ports does not require any open (listening) ports on external interfaces, so there is no network attack surface on devices using SSH No Ports.
SSH No ports provide relays like Ngrok, but connections are authenticated then connected. Once connected, the connection is encrypted with ephemeral (AES256) keys that the relay never has or needs.
SSH No ports abstracts away the TCP/IP layer, so whilst IP address on the client or device may change, the command you use never does.
Is the relay necessary?
The relay ensures that connections from client and server are always outbound, removing the need for listening ports, firewall rules, and network attack surfaces on devices.
SSH No ports uses TCP sockets to communicate. "Hole punching" can work sometimes, but we decided to never do that. Using the relay, you know that SSH No Ports will always work and is friendly to both network admins and firewall rules.
For most customers our relay service is robust and placed regionally. The relay code is open and the binaries are part of the distribution, so you can place your own relay where it makes sense for your network.
If a bad actor takes down the relay, does the tool fail?
In the unlikely event that a bad actor takes down an relay, the tool will indeed fail. Fortunately, we run multiple relays, so if one is down or unavailable, you can easily switch to another.
Since the device and the client need to connect out to the relays, do I need to open ports on my firewall for them to connect out to the SR?
You do not need to open any inbound ports to connect out to the relay. However, the outbound traffic to the relay server does need to be open. Outbound access is, in most situations, automatically allowed so things just work. If you work in a location where outbound access is also controlled, then please contact us as we have options for for your IT team.
Who pays the ingress & egress costs to the relay?
These costs are included in the SSH No Ports subscription.
Why is additional encryption needed when SSH provides its own encryption?
Is SSH No Ports a reverse SSH tunnel?
SSH No Ports is similar to a reverse tunnel in that it has the remote device start an outbound SSH session. What makes SSH No Ports better than a reverse SSH tunnel is that you don’t need access to the device to initiate it. This means you don’t need to leave open ports when not in use (i.e. there are no network attack surfaces).
The TCP layer is not taken out in your architecture. Does your protocol run over and above it?
Yes. SSH No Ports uses the atProtocol which runs on TCP. In order for SSH No Ports to reach the device, the device must have an IP address. However, it does not need to be a static IP address, and SSH No Ports doesn't even need to know what the IP address is. So, even though it runs over TCP/IP, it does away with all the pain of finding and managing IP addresses.
So, you can SSH without any open ports...what about RDP?
How do I close port 22?
To close port 22, edit /etc/ssh/sshd_config remove any lines containing ListenAddress and then add ListenAddress localhost on a new line. Then restart your sshd service (this varies by operating system, a quick web search will help you figure how to do it for your device).
Did we miss something?
If you have a question that needs answering, please do one of the following:
Last updated