ELX-ShellHub
RU Sign up Sign in

SSH gateway for machines behind NAT

SSH access to Linux and Windows — without a public IP

ShellHub connects you to a computer, server or single-board machine that has no public IP address. Nothing to configure on the router, nothing exposed to the internet: the agent dials out to the gateway over port 443, and you log in with your usual SSH client or straight from the browser.

Get started free How it works
  • Works behind NAT, on mobile networks and through corporate firewalls
  • PuTTY, MobaXterm, OpenSSH, WinSCP — no proprietary client
  • One-command agent install

What ShellHub does

A real SSH channel, not a cut-down web console: everything you expect from a terminal works over the tunnel.

Terminal and commands

Interactive shell with a full PTY, one-off command execution, switching to a specific system user. Plus a browser terminal for when no client is at hand.

File transfer

Full SFTP subsystem — WinSCP, FileZilla, the MobaXterm file browser and modern scp all work. No extra service to run.

Port forwarding

-L tunnels expose a device's web interface (Node-RED, Home Assistant, a router) as localhost in your browser. The -D SOCKS proxy opens up the device's whole local network.

Device dashboard

Web panel with Online / Offline status, live CPU and memory load, uptime, notes, colour tags and a ready-to-copy connection command.

Telegram alerts

A Telegram message when a device drops off or comes back. Enabled per machine, with silent mode and proxy support.

Agent auto-update

The agent pulls a new build from the gateway and restarts itself. No walking through dozens of machines by hand — update the gateway, everything follows.

How it works

Classic port forwarding needs a public IP and an open port on the router. ShellHub flips it around: the device itself opens the connection — outbound, just like a browser does.

  1. 1

    The agent dials out

    A small service runs on the device and opens an outbound WebSocket connection on port 443 — the same port every website uses, so NAT, mobile carriers and corporate firewalls let it through.

  2. 2

    You approve the device

    A new machine lands in the pending list in the web panel. Until you press Accept, nobody can reach it — a stranger's agent will not attach itself to your account.

  3. 3

    Connect as usual

    Point your SSH client at the gateway and name the target device right in the username. Traffic flows through the established tunnel, and the device stays invisible from the internet.

Who it's for

Home servers and SBCs

Raspberry Pi, Orange Pi, mini-PCs and NAS boxes behind a home router stay reachable even when the ISP hands out a shared, ever-changing address.

Smart home and industrial gear

Controllers on sites where there is neither a static address nor any way to touch someone else's network settings — plus a Telegram alert when a site goes dark.

Support and sysadmin work

Dozens of machines across different clients in one list, with readable names and notes. No more remembering which VPN belongs to whom.

Up and running in minutes

  1. Create an account

    Sign up with your email — create an account. Already have one? Sign in.

  2. Install the agent

    On Linux it's a single command — the script detects the architecture and sets up a systemd service:

    curl -fsSL https://shellhub.ru/install/install.sh | sudo bash

    A separate PowerShell installer for Windows is available in the panel.

  3. Approve it and connect

    The machine shows up in your list — press Accept, copy the prepared command and connect:

    ssh your-account+device-name@shellhub.ru -p 2222
Create an account Sign in

Frequently asked questions

Do I need a public IP address?

No. The agent opens an outbound connection to the gateway on port 443, so no public IP and no router port forwarding are required. It works behind NAT, on mobile networks and through corporate firewalls.

Which SSH clients are supported?

Any standard one: OpenSSH, PuTTY, MobaXterm, WinSCP, FileZilla. There is no proprietary client to install — you connect to the gateway's regular SSH port. A browser terminal is available too.

Which systems does the agent support?

Linux on amd64, arm64 and armv7 — regular servers as well as Raspberry Pi and other single-board computers — plus Windows. On Linux the agent installs with one command and runs as a systemd service.

How secure is it?

The agent-to-gateway link is TLS encrypted; your side of the connection is plain SSH. A new device gets no access until you approve it in the panel, and only the account owner can see it. Device tokens can be revoked at any time.

Can I open a device's web interface in my browser?

Yes, through port forwarding: ssh -N -L 8080:127.0.0.1:1880 exposes the device's service on localhost:8080 on your machine. The -D SOCKS proxy gives you the device's entire local network.

How many devices can I connect?

There is no cap — every machine lands in the same list, is told apart by name, and connects through the same gateway port.