Skip to content

Commit 91fb978

Browse files
isonthelineisontheline
committed
Add documentation for accessing homelab services via SSH tunnel on iOS, SSH to Synology NAS, and SFTP file transfer on iPhone and iPad
1 parent e7e24f4 commit 91fb978

5 files changed

Lines changed: 531 additions & 0 deletions

File tree

‎documentation/src/docs/documentation/guides/homelab-ssh-tunnel-ios.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
---
2+
title: Access Your Homelab Remotely via SSH Tunnel on iOS
3+
---
4+
5+
# Access Your Homelab Remotely via SSH Tunnel on iOS
6+
7+
Your homelab runs services you don't want exposed to the internet — a Proxmox dashboard, a Grafana instance, a private Git server, an internal wiki. SSH tunneling lets you reach all of them securely from your iPhone or iPad, without a VPN appliance, without opening extra firewall ports, and without a subscription.
8+
9+
This guide shows you how to use WebSSH's port forwarding features to access homelab services from anywhere.
10+
11+
## How SSH Tunneling Works
12+
13+
An SSH tunnel creates an encrypted channel between your iOS device and a server you control (the "jump host" — typically a VPS or a machine in your homelab with SSH exposed). Once the tunnel is established, WebSSH forwards traffic through it, letting you reach internal services as if you were on your home network.
14+
15+
Two modes are available in WebSSH:
16+
17+
| Mode | Use case |
18+
|---|---|
19+
| **Local Port Forwarding** | Access a specific service on a specific port |
20+
| **Dynamic Port Forwarding** | Use your server as a SOCKS proxy for multiple services at once |
21+
22+
## Prerequisites
23+
24+
You need one machine accessible from the internet over SSH. This is your entry point:
25+
26+
- A **VPS** (DigitalOcean, Hetzner, Linode, etc.) with SSH enabled
27+
- Or a homelab machine with a port forwarded from your router
28+
29+
!!! tip "A small VPS is all you need"
30+
A €4/month VPS is enough to act as a jump host. All your homelab traffic goes through it encrypted — the VPS never sees the content, just the forwarded connection.
31+
32+
## Local Port Forwarding — Access One Service
33+
34+
Local Port Forwarding (LPF) maps a port on your iPhone to a port on a remote server. Once active, any connection WebSSH makes to `localhost:LOCAL_PORT` goes through the SSH tunnel to `REMOTE_HOST:REMOTE_PORT`.
35+
36+
**Example: access a Proxmox web UI running on `192.168.1.10:8006`**
37+
38+
1. Open **WebSSH** and go to the **Tunnel** tab
39+
2. Tap **+** to create a new tunnel
40+
3. Fill in the SSH connection details for your jump host
41+
4. In the **Port Forwarding** field, enter:
42+
```
43+
8006:192.168.1.10:8006
44+
```
45+
5. Save the tunnel and tap it to start it
46+
6. Open WebSSH's built-in browser and navigate to `https://localhost:8006`
47+
48+
!!! tip "Port Forwarding syntax"
49+
The format is `LOCAL_PORT:REMOTE_HOST:REMOTE_PORT`. The remote host is resolved from the perspective of the SSH server — so `localhost` means the SSH server itself, and `192.168.1.10` means a machine on the same LAN as the SSH server.
50+
51+
**More examples:**
52+
53+
| Forward Rule | What it does |
54+
|---|---|
55+
| `3000:localhost:3000` | Grafana on the jump host itself |
56+
| `8080:192.168.1.50:80` | Web UI on a NAS at 192.168.1.50 |
57+
| `5432:192.168.1.20:5432` | PostgreSQL on an internal server |
58+
59+
See [Local Port Forwarding](/documentation/help/networking/local-port-forwarding/) for the full documentation.
60+
61+
## Dynamic Port Forwarding — Access Everything at Once
62+
63+
Dynamic Port Forwarding (DPF) turns your jump host into a SOCKS proxy. All connections made within WebSSH are routed through it — useful when you need to reach multiple internal services without creating one tunnel per service.
64+
65+
1. Go to the **Tunnel** tab in WebSSH
66+
2. Tap **+** to create a new tunnel
67+
3. Fill in the SSH connection details for your jump host
68+
4. In the **Port Forwarding** field, enter `*` (an asterisk)
69+
5. Save and start the tunnel
70+
6. Now open any SSH or SFTP connection inside WebSSH — it will go through the tunnel and can reach internal addresses
71+
72+
!!! warning "DPF only routes WebSSH traffic"
73+
Dynamic Port Forwarding routes connections made within WebSSH only. Other apps on your iPhone (Safari, etc.) are not affected.
74+
75+
See [Dynamic Port Forwarding](/documentation/help/networking/dynamic-port-forwarding/) for the full documentation.
76+
77+
## Securing Your Jump Host
78+
79+
If your jump host is exposed to the internet, take a few minutes to harden it:
80+
81+
- **Use key-based SSH authentication** — disable password login in `/etc/ssh/sshd_config` with `PasswordAuthentication no`
82+
- **Use a non-standard SSH port** — reduces automated scan noise
83+
- **Set up fail2ban** — automatically bans IPs with repeated failed login attempts
84+
- **Keep the system updated** — `apt update && apt upgrade` regularly
85+
86+
See [SSH Public / Private Key Pair](/documentation/help/SSH/public-private-key/) for setting up key auth with WebSSH.
87+
88+
## Troubleshooting
89+
90+
??? question "Tunnel connects but I can't reach the internal service"
91+
Check that the port forwarding rule uses the correct remote address. The remote host is resolved from the SSH server's perspective. If the service is on the same machine as the SSH server, use `localhost`. If it's on another machine, use its LAN IP.
92+
93+
??? question "Connection refused on the local port"
94+
The tunnel must be running (green/active) before you try to connect. Tap the tunnel to start it, then make your connection.
95+
96+
??? question "Tunnel drops after a few minutes of inactivity"
97+
SSH connections can time out. Configure `ServerAliveInterval` in your ssh_config file on the server side, or use tmux on the jump host to keep sessions alive.
98+
99+
??? question "I need to access multiple homelab machines"
100+
Use Dynamic Port Forwarding (`*`) — this creates a SOCKS proxy so WebSSH can route to any internal address through a single tunnel. Alternatively, set up multiple Local Port Forwarding rules separated by commas (e.g. `8006:192.168.1.10:8006,3000:192.168.1.20:3000`).
101+
102+
## Related Documentation
103+
104+
- [Port Forwarding overview](/documentation/help/networking/port-forwarding/)
105+
- [Local Port Forwarding](/documentation/help/networking/local-port-forwarding/)
106+
- [Dynamic Port Forwarding](/documentation/help/networking/dynamic-port-forwarding/)
107+
- [VPN-Over-SSH](/documentation/help/networking/vpn-over-ssh/)
108+
- [Port Knocking](/documentation/help/networking/port-knocking/) — hide your SSH port until you knock

‎documentation/src/docs/documentation/guides/no-subscription-ssh-client-ios.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
title: Best SSH Client for iOS Without a Subscription
3+
---
4+
5+
# Best SSH Client for iOS Without a Subscription
6+
7+
Most SSH clients on the App Store have quietly moved to subscription pricing. You pay monthly or annually — or you lose access to your connections, your keys, and your tunnels. If you're looking for a capable SSH and SFTP client for iPhone or iPad that you buy once and own forever, this page is for you.
8+
9+
## The Problem with Subscription SSH Clients
10+
11+
Subscription-based apps make financial sense for the developer, but they create a real problem for the user:
12+
13+
- **Ongoing cost** — a $9.99/month SSH client costs more per year than most desktop tools
14+
- **Held hostage** — if you stop paying, your saved connections and keys may become inaccessible
15+
- **Privacy concerns** — some sync your server credentials to the developer's cloud infrastructure
16+
17+
If you use SSH professionally, you're already paying for servers, VPNs, and tooling. Your SSH client shouldn't be another recurring line item.
18+
19+
## WebSSH: One Purchase, No Subscription
20+
21+
WebSSH has been on the App Store since **2012** — over a decade of continuous updates, maintained by a single developer, funded entirely by one-time purchases.
22+
23+
!!! abstract "What you get with a single purchase"
24+
- WebSSH PRO on **all your Apple devices** (iPhone, iPad, Mac, and even Vision Pro) with the same Apple ID
25+
- Every future update included — no "PRO 2.0" upsell
26+
- Family Sharing support — up to 6 family members, no extra cost
27+
- No ads, no data collection, no marketing tracking
28+
29+
The free version is generous: full SSH, SFTP, and Telnet support, with one saved connection. If you need more saved connections, the PRO upgrade is a one-time purchase.
30+
31+
## Feature Comparison
32+
33+
See the [full feature comparison](/documentation/pricing/) for FREE vs PRO details.
34+
35+
## Your Data Stays on Your Device
36+
37+
WebSSH stores your connections, credentials, and private keys locally on your device. Sync across your own Apple devices happens through your personal iCloud account — your data never passes through any third-party server.
38+
39+
This matters when you're storing SSH private keys and server credentials. You should know exactly where that data lives.
40+
41+
**Keep connections organised:**
42+
43+
Use groups and tags to organise servers by environment (production, staging, homelab) or client. See [Arrange Connections Inside Folders](/documentation/help/howtos/arrange-connections-inside-folders/).
44+
45+
## Student and Educator Discounts
46+
47+
If the one-time price is a barrier, discounts are available for students and educators. [Contact me](/documentation/contact-me/) for a discount code.
48+
49+
## Frequently Asked Questions
50+
51+
??? question "If I buy on iPhone, do I get it on iPad too?"
52+
Yes. One purchase unlocks PRO on all devices using the same Apple ID — iPhone, iPad, Mac, and Vision Pro.
53+
54+
??? question "Does WebSSH support Apple Family Sharing?"
55+
Yes. One purchase can be shared with up to 6 family members through Apple's Family Sharing feature.
56+
57+
??? question "Will future versions be free updates or paid upgrades?"
58+
All updates to WebSSH have been free since 2012. There has never been a paid major version upgrade.
59+
60+
??? question "What happens if I delete the app?"
61+
Your purchase is tied to your Apple ID. Reinstall WebSSH and restore your purchase from **Settings → App Store → Restore Purchase**. See [Restore Purchases](/documentation/help/restore-purchases/).
62+
63+
??? question "Can I try before I buy?"
64+
Yes. The free version of WebSSH is fully functional with one saved connection. Use it as long as you need before deciding.
65+
66+
## Get Started
67+
68+
- [Download WebSSH on the App Store](https://apps.apple.com/us/app/webssh-sysadmin-tools/id497714887)
69+
- [SSH into a Synology NAS from iPhone or iPad](/documentation/guides/synology-ssh-iphone-ipad/)
70+
- [SSH into a Raspberry Pi from iPhone or iPad](/documentation/guides/raspberry-pi-ssh-ios/)
71+
- [Access Your Homelab via SSH Tunnel on iOS](/documentation/guides/homelab-ssh-tunnel-ios/)
72+
- [Transfer Files via SFTP on iPhone and iPad](/documentation/guides/sftp-file-transfer-iphone/)

‎documentation/src/docs/documentation/guides/raspberry-pi-ssh-ios.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
title: How to SSH into a Raspberry Pi from iPhone or iPad
3+
---
4+
5+
# How to SSH into a Raspberry Pi from iPhone or iPad
6+
7+
The Raspberry Pi is a staple of home labs, automation projects, and self-hosted services. WebSSH turns your iPhone or iPad into a capable terminal — so you can check logs, restart services, or run commands on your Pi without needing a laptop nearby.
8+
9+
This guide covers everything from enabling SSH on the Pi to connecting securely from iOS with a private key.
10+
11+
## Prerequisites
12+
13+
### Enable SSH on Your Raspberry Pi
14+
15+
SSH is disabled by default on recent Raspberry Pi OS images. Enable it before trying to connect.
16+
17+
**If you have physical access to the Pi:**
18+
19+
1. Open a terminal on the Pi (or connect a keyboard and monitor)
20+
2. Run `sudo raspi-config`
21+
3. Navigate to **Interface Options → SSH → Enable**
22+
4. Reboot: `sudo reboot`
23+
24+
**Headless setup (no monitor needed):**
25+
26+
Before first boot, place an empty file named `ssh` (no extension) in the `/boot` partition of the SD card. The Pi will enable SSH automatically on first boot.
27+
28+
### Find Your Pi's IP Address
29+
30+
From another device on the same network, you can find the Pi's IP with:
31+
32+
```bash
33+
ping raspberrypi.local
34+
```
35+
36+
Or check your router's DHCP table. The Pi's hostname is `raspberrypi` by default (or whatever you set it to).
37+
38+
!!! tip "Set a static IP"
39+
For a device you'll connect to regularly, assign a static IP in your router's DHCP settings or configure a static address on the Pi itself. This way the address never changes.
40+
41+
## Add the Connection in WebSSH
42+
43+
1. Open **WebSSH** on your iPhone or iPad
44+
2. Tap **+** to create a new connection
45+
3. Fill in the fields:
46+
- **Name:** e.g. `Pi - Home Lab`
47+
- **Host:** your Pi's IP address or `raspberrypi.local`
48+
- **Port:** `22` (default)
49+
- **Username:** `pi` (default) or whatever user you created
50+
4. Choose **Password** or **Private Key** for authentication
51+
5. Tap **Save**, then tap the connection to connect
52+
53+
!!! warning "Change the default password"
54+
The default `pi` user with password `raspberry` is well known. If you haven't already, change it with `passwd` before exposing SSH to any network.
55+
56+
## Use Key-Based Authentication (Recommended)
57+
58+
A private key is both more secure and more convenient than a password. Here's how to set it up using WebSSH:
59+
60+
**Step 1 — Generate a key in WebSSH:**
61+
62+
1. Go to **Settings** (gear icon)
63+
2. Tap **SSH Keys → + → Generate**
64+
3. Choose **ED25519**
65+
4. Tap the key to copy the public key
66+
67+
**Step 2 — Authorize the key on the Pi:**
68+
69+
Connect once with a password, then run:
70+
71+
```bash
72+
mkdir -p ~/.ssh
73+
echo "PASTE_YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
74+
chmod 700 ~/.ssh
75+
chmod 600 ~/.ssh/authorized_keys
76+
```
77+
78+
**Step 3 — Update your WebSSH connection:**
79+
80+
Edit the connection and switch authentication to your private key. You won't be asked for a password again.
81+
82+
## Connecting to Your Pi from Outside Your Home
83+
84+
By default, your Pi is only reachable from your local network. To reach it from anywhere:
85+
86+
**Option 1 — Port forwarding (simple, less secure):**
87+
88+
Forward port `22` (or a custom port) from your router to the Pi's local IP. Then connect using your public IP or a dynamic DNS hostname.
89+
90+
!!! warning "If you expose SSH to the internet"
91+
Use key-based auth only. Disable password authentication in `/etc/ssh/sshd_config` by setting `PasswordAuthentication no`.
92+
93+
**Option 2 — SSH tunnel through a VPS (more secure):**
94+
95+
If you have a cheap VPS or cloud server, you can set up a reverse tunnel so the Pi connects outward to the VPS, and you SSH into the VPS to reach the Pi. This avoids opening any ports on your home router.
96+
97+
**Option 3 — Tailscale or WireGuard:**
98+
99+
Install a VPN like Tailscale on the Pi and your iPhone. No port forwarding needed; everything is encrypted peer-to-peer.
100+
101+
## Multiple Terminals at Once
102+
103+
WebSSH lets you open multiple SSH sessions simultaneously. Useful when you need one terminal for logs and another for commands:
104+
105+
1. Connect to your Pi
106+
2. Tap the terminal icon to open another session
107+
3. See [Launching Multiple Terminals](/documentation/help/howtos/launching-multiple-terminals/) for details
108+
109+
## Troubleshooting
110+
111+
??? question "ssh: connect to host raspberrypi.local port 22: Connection refused"
112+
SSH is not enabled. Connect a monitor and keyboard to the Pi, run `sudo raspi-config` and enable SSH under Interface Options.
113+
114+
??? question "raspberrypi.local doesn't resolve"
115+
mDNS (Bonjour) may not be working on your network. Use the Pi's IP address directly instead. Find it in your router's DHCP table or run `hostname -I` on the Pi.
116+
117+
??? question "Permission denied (publickey)"
118+
The public key isn't correctly installed on the Pi. Check that `~/.ssh/authorized_keys` contains your key, and that permissions are `700` for `~/.ssh` and `600` for `authorized_keys`.
119+
120+
??? question "Connection drops when I switch apps"
121+
This is an iOS background execution limit. On iPad, use Split View or Slide Over to keep WebSSH visible. See [tmux](/documentation/help/howtos/tmux/create-attach-existing-tmux-session/) to keep your session alive server-side regardless of the iOS connection state.
122+
123+
## Related Documentation
124+
125+
- [SSH Public / Private Key Pair](/documentation/help/SSH/public-private-key/)
126+
- [Local Port Forwarding](/documentation/help/networking/local-port-forwarding/) — access services running on the Pi (web UI, databases, etc.)
127+
- [tmux — Create or Attach to an Existing Session](/documentation/help/howtos/tmux/create-attach-existing-tmux-session/)
128+
- [Launching Multiple Terminals](/documentation/help/howtos/launching-multiple-terminals/)

0 commit comments

Comments
 (0)