Setup ssh server in Debian/Linux and access from internet.

What we will need

Root access to the server and router configuration page. Registration to a Dynamic DNS (DDNS) Service.

In a nutshell

Having a debian server inside your home offer many benefits. Streaming content, pihole, backup, alarms, cameras, VDR, etc.

If you are a console addict like myself, the best and most efficient way to administer all that instead of physically connecting to the machine is through ssh.
In this tutorial we will show how to setup and connect to your server through ssh.

Afterwards, we will proceed one step further and make that server accessible not only from your local network but also from the internet.
For simplicity, it is assumed that the only active firewall in your home network is your router's default from the provider.

Part 1: Install and setup ssh server

Let's go ahead and install necessary package and set to auto start on boot.

$ apt-get install openssh-server
$ systemctl enable ssh
$ systemctl start ssh

Now, if everything is set you should have an ssh server up and running. Try to login from an ssh client inside your local network

$ ssh [debian_username]@[debian_server_local_ip]

Normally, you should see a prompt for your debian password and boom! You have been remotely connected to your Debian.
Instead of using the local ip of your Debian (which is assigned by your router using DHCP and is dynamic, thus not the same every time), you can use the hostname of your Debian.

$ ssh [debian_username]@[debian_hostname]

That way you don't have to worry about the local IP of your Debian server changing all the time.
Your router using DNS will resolve to the correct IP and route it.

However since this is a tutorial about accessing the server from internet and not only from local network, a good practice which I recommend following is set a static local IP to your server.

Part 2: Assign static local IP to debian server using DHCP binding

Since you will depend on your server a lot, why not assign it a static internal IP and make your life easier?
We will do so, with a feature called DHCP binding.

Go ahead and login your router configuration web page. In home setups it is usually in subnets 192.168.1.0/24 or 192.168.2.0/24.

Let's suppose the ip of your home router is 192.168.2.1.
Provide username and password.

Depending on your router firmware and maker you must locate the where DHCP server config part is. In my case (ZTE H268Q) is under Local Network / LAN / DHCP Server. There you must find a section called DHCP binding.

In DHCP binding when a client device requests an IP from your router using DHCP protocol, instead of getting assigned one randomly in the subnet (imagine that as a temporary "rent" of the IP), it is assigned the same with every request (equivalent of "buying" it).

You can instruct the router to bind the device's MAC address to an IP of your choice. That way you don't have to worry about the local IP of your Debian server getting changed all the time. Let's query our Debian server in order to find the MAC address.

$ ip link

Locate your network interface used to connect your server on the network (usually something like enp1s0, enp2s0, eno1, eno2 etc).

Look for link/ether [MAC_ADDRESS] (6 hexadecimal pairs with colon separators).
This is the MAC address in your network card and this is what is going to be used for the DCHP binding in order to set the router to provide a fixed IP for that specific client device.

Back to your router config create a new DHCP binding.
Give a name (ex: debian-vsrv-binding), fill the MAC address you got from above command and set your desire IP address.

If your router IP address, the one you entered in your browser to access router config, is 192.168.2.1 you can give your server anything after that.
I gave mine the 192.168.2.3 so from now on we'll assume you did the same.

Hit the apply button, reconnect your Debian server on the internet (or restart the server) and confirm the IP by running:

$ ifconfig [network_interface_id]
# Replace with the network interface mentioned earlier for the MAC address

Look for inet [IP] netmask 255.255.255.0

If all went well your IP should be 192.168.2.3 and kept static!

Now, we are ready to proceed to the third part of this tutorial.

Part 3: Make your server accessible to the world!

In home setups your internet provider assigns you with a dynamic IP address unless specifically requested otherwise on your contract - usually with an extra fee. (you already know everything about dynamic IP now right 😀?).

That means if you want access your home network from the internet, you would have to write down your provider assigned IP every time the DHCP lease expires (normally 24h).

In order to overcome this, we will make use of a feature called DDNS. This way instead of attempting to connect by providing your public IP (ex. ssh [email protected]) which is always changing, we will query a domain name instead (such as guest.dnsfor.me) that the DNS service will resolve automatically to the correct public IP every time.

Firstly, let's create an account to a free DDNS service. There are many options available, select according to your needs. We will need to create an A Record.

When the registration to the DDNS service is completed, go ahead and select "Create Hostname".

Select a hostname (ex. guest) and a domain name from the provided list (ex. dnsfor.me). Select record type: A. Now there should be a field requesting for an IP Address. Provide your IP address (the temporary one your provider assigned you). Go ahead and click "Create".

Now if you ping guest.dnsfor.me your request should be handled by your DNS service and translated to the public IP of your server provided above. And instead of pinging with IP you can ping with hostname and domain. However, in our case as mentioned earlier, your IP is constantly changing and above would only work until DHCP lease expires.

In order to overcome that, we have to go back to your router admin page and let the router know, that we now have a DDNS service that he has to update and provide it with every new IP obtained, in order for the guest.dnsfor.me to always translate properly and not require the IP update from you manually every 24h.

In your router config page look for DDNS (Dynamic DNS) usually found under Internet Configuration .

• Enable it
• Select your provider from list (the account created right before)
• Add username/password and hostname

Apply.

Congratulations! You can now ping your network from the internet without requiring manual IP submission but using your desired hostname instead. And the best part is that you don't have to worry about your IP getting changed. Your router will be in contact with the DDNS service and do the labour for you.

So far we have

1. Setup ssh service in our Debian server
2. Provided static local IP in our Debian server
3. Added a DNS record for our public IP, making our home network easily reachable from the Internet.

Remaining steps

1. Access our ssh server from the Internet.

By default in home routers the embedded firewall has all incoming ports blocked. This is the best practice for the average user since we don't want the outside world to be able to access our home network. But you are not the average user, are you? 😋

So for the ssh service to be accessible to the outside, we must instruct our firewall to open TCP Port 22 (ssh works on TCP sockets) and forward to TCP port 22 of our Debian server. That way when a request for port 22 reaches our router from the internet, it will be sent to the correct place to be handled.

Even better we can open another port (ex 2223) instead of the default for security reasons, and forward to port 22 of our Debian server. Go ahead in your router config page Under Internet / Security (or Firewall) / Port Forwarding. Add new item with name Debian-ssh.

• Protocol: TCP.
• WAN Host IP: 0.0.0.0 ~ 0.0.0.0 (translates to whatever reaches me from outside)
• Lan Host: 192.168.2.3 (Our Debian server local IP address. Remember we made it static in previous step?)
• WAN Port: 2223 ~ 2223 (The outside port - Internet side)
• LAN Host Port: 22 ~ 22. (Debian server port - Intranet side).

And save.

Now, we have established ssh in port 2223 of your network. Go ahead open a Hotspot from your mobile. Connect to that hotspot from a device with ssh client.

$ ssh [user]@guest.dnsfor.me -p 2223

If all went well, you should get a prompt for password!! You are now succesfully connected to your home debian server from the internet.