Skip to content

Reverse Tunnels

Reverse tunnels let you publish a service that is running behind a firewall or on a computer that does not have a public IP address.

How It Works

Instead of the gateway reaching out to your service, your service connects to the gateway through SSH and asks the gateway to forward traffic back down the connection. This is useful for:

  • Home or office servers behind a router.
  • Temporary demos or development environments.
  • Devices that cannot expose ports directly to the internet.

Enable the Tunnel Account

The tunnel account is enabled automatically when you start the container with port 2222 mapped. The account is called gateway and can only be used for forwarding. It cannot be used to open a shell or run commands.

[!NOTE] If you do not need reverse tunnels, you can leave port 2222 unmapped. The gateway will still work for normal services.

Add Your SSH Public Key

You need to add the public key of the computer that will create the tunnel.

From the dashboard:

  1. Go to the SSH Access Keys section.
  2. Paste your public key. It usually looks like ssh-ed25519 AAAAC3Nza... user@host.
  3. Save the key.

Or use the API:

curl -sku admin:'replace-with-strong-password' \
  -X POST https://your-server-address:8443/api/ssh-keys \
  -H 'Content-Type: application/json' \
  -d '{"publicKey":"ssh-ed25519 AAAAC3Nza... user@host"}'

Create a Reverse Tunnel

On the computer running the service you want to publish, run:

ssh -N -R 8080:127.0.0.1:8080 -p 2222 gateway@your-gateway-address

This tells the gateway:

  • Forward traffic that arrives at the gateway on port 8080.
  • Send it through the tunnel to port 8080 on the local computer.

[!TIP] Add the -f and -o ServerAliveInterval=30 options if you want the tunnel to stay open in the background and recover from idle timeouts.

Publish the Tunneled Service

In the Aegis Gateway dashboard, create a service that points to the tunnel port on the gateway itself:

  • Public domain name: demo.example.com
  • Back-end address: http://127.0.0.1:8080

When visitors go to https://demo.example.com, Aegis Gateway will route the traffic through the tunnel to your local service.

[!IMPORTANT] Make sure the tunnel is running before you expect visitors to reach the service. If the tunnel disconnects, the service will be marked offline until the tunnel reconnects.