Documentation

Quick start

ssh -R 80:localhost:3000 serveo.net

The -R option instructs your SSH client to request port forwarding from the server and proxy requests to the specified host and port (usually localhost). A subdomain of serveo.net will be assigned to forward HTTP traffic.

Node.js shortcut

If you already have Node.js 18 or newer, the official zero-dependency wrapper can build and run the SSH command for you without a global install:

npx serveo-cli 3000

It uses the OpenSSH client already installed on your computer. The regular SSH command above remains the simplest option when you do not need a Node.js tool.

Common options use port 443 on restrictive networks, override the Host header for local development servers, or print the SSH command without running it:

npx serveo-cli 3000 --ssh-port 443
npx serveo-cli 3000 --host-header localhost:3000
npx serveo-cli 3000 --dry-run

New to SSH?

You can try an anonymous tunnel without creating an account or key. Adding your public key to the Serveo Console gives the connection your Serveo identity, which is required for reserved hostnames and paid features. Your private key stays on your computer.

ssh -V
ssh -R 80:localhost:3000 serveo.net

ssh-keygen -t ed25519 -C "serveo"
cat ~/.ssh/id_ed25519.pub

ssh -V
ssh -R 80:localhost:3000 serveo.net

ssh-keygen -t ed25519 -C "serveo"
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

SSH proxy options

Some development servers expect a particular HTTP Host header. Pass a connection-scoped Host override as the SSH exec payload:

ssh -R 80:localhost:3000 -- serveo.net --host-header=localhost:3000

The first -- stops OpenSSH option parsing. Do not use -N when passing proxy options. The -R destination still selects the local service; this option only changes the Host header sent to it.

Host names, IPv4 addresses, bracketed IPv6 addresses, and optional ports are accepted. Options apply to every HTTP forward on that SSH connection until you reconnect.

ssh -R 80:localhost:3000 -- serveo.net --https-only --request-header=X-Environment:preview --remove-request-header=Cookie

Serveo rejects routing, forwarding, hop-by-hop, and internal metadata headers. Each header may be set or removed once, and the two operations cannot target the same header. Header values cannot contain spaces or control characters. Avoid putting long-lived credentials in command history.

Request multiple tunnels at once

ssh -R 80:localhost:8888 -R 80:localhost:9999 serveo.net

The target server doesn't have to be on localhost

ssh -R 80:example.com:80 serveo.net

Request a particular subdomain

The subdomain is chosen deterministically based on your IP address, the provided SSH username, and subdomain availability, so you'll often get the same subdomain between restarts. You can also request a particular subdomain:

ssh -R incubo:80:localhost:8888 serveo.net

ssh -R incubo.serveo.net:80:localhost:8888 serveo.net

Change the SSH username to get assigned a different subdomain:

ssh -R 80:localhost:8888 foo@serveo.net

ssh -R 80:localhost:8888 -l foo serveo.net

Private TCP and SSH forwarding

Serveo can be used to route private TCP traffic, almost like a lightweight VPN. To set up the tunnel, specify an alias as the hostname and some port:

ssh -R myalias:5901:localhost:5900 serveo.net

Then to connect to that port from another machine, use ssh -L:

ssh -L 5902:myalias:5901 serveo.net

Then connect to localhost:5902 on the remote machine, and SSH will send traffic through Serveo, which will forward it to the target machine, ultimately connecting you to port 5900 on the target machine.

If you're using this to connect to an SSH server, then you can use OpenSSH's JumpHost feature. On the target machine, you might start the tunnel like this:

ssh -R myalias:22:localhost:22 serveo.net

Then you can establish an SSH connection using serveo.net as an intermediary like this:

ssh -J serveo.net user@myalias

The -J option was introduced in the OpenSSH client version 7.3. If you have an older client, you can use the ProxyCommand option instead:

ssh -o ProxyCommand="ssh -W myalias:22 serveo.net" user@myalias

Private aliases do not open a public Internet port, but they are shared routing names rather than an authentication boundary. Choose an unguessable alias for sensitive services and keep application-level authentication enabled. See the complete remote SSH guide for keepalives, persistent Linux setup, Windows guidance, and troubleshooting.

Public TCP forwarding

Registered users can request a public raw TCP listener on port 1024 or higher. Port 80 creates an HTTP tunnel instead. A hostname or alias before the port creates a private TCP forward rather than a public listener.

Public TCP traffic does not pass through Serveo's HTTP proxy, browser warning, or HTTP abuse-capture controls. Keep authentication enabled on the forwarded service.

ssh -R 1492:localhost:1492 serveo.net

If port 0 is requested, a random TCP port will be forwarded:

ssh -R 0:localhost:1492 serveo.net

Connect on port 443

In some environments, outbound port 22 connections are blocked. For this reason, you can also connect on port 443.

ssh -p 443 -R 80:localhost:8888 serveo.net

Automatically reconnect

Use autossh for more persistent tunnels. Use "-M 0" to disable autossh's connectivity checking:

autossh -M 0 -R 80:localhost:8888 serveo.net

See https://www.everythingcli.org/ssh-tunnelling-for-fun-and-profit-autossh/ for more about autossh.

Browser Warning

To prevent phishing and abuse, Serveo displays an interstitial warning page when browsers visit endpoints served by anonymous or free-account tunnels. Users can continue through the warning in their browser; paid tunnels do not show it.

For automated access (like APIs), you can bypass the warning by adding the following request header:

serveo-skip-browser-warning: true

Browser extension

The Serveo Chrome extension can expose localhost without a terminal. Install the extension, sign in to the Serveo Console, and reserve a hostname from the Domains page.

1. Install Serveo from the Chrome Web Store and sign in.
2. Add or select a hostname in the Serveo Console.
3. Open the extension, enter the local port, choose the hostname, and start the tunnel.

WireGuard Tunnels

As an alternative to SSH, Serveo supports WireGuard, a modern, high-performance VPN protocol. WireGuard connections are just as private as SSH but are often more efficient and can provide a better experience for permanent tunnels.

Configure a persistent HTTP tunnel in the Serveo Console:

1. Add a domain and choose WireGuard as its connection method.
2. Create or select a WireGuard peer, then enter the local HTTP port.
3. Keep the generated private key safe; Serveo stores only the public key.
4. Load the configuration into wg-quick or an official WireGuard app and activate it.

Once connected, Serveo will forward traffic for that domain to the specified port on your device over the secure WireGuard tunnel.

Custom Domain

To use your own domain or subdomain, you'll first need an SSH key pair. Use the ssh-keygen program to generate a key pair if you don't already have one.

Next, use ssh-keygen -l and note your key's fingerprint. Here's an example output:

2048 SHA256:pmc7ZRv7ymCmghUwHoJWEm5ToSTd33ryeDeps5RnfRY no comment (RSA)

In this example, the fingerprint is SHA256:pmc7ZRv7ymCmghUwHoJWEm5ToSTd33ryeDeps5RnfRY.

Now you need to add two DNS records for the domain or subdomain you'd like to use:

• A CNAME record pointing to serveo.net.
• For each SSH key to allow, a TXT record at _serveo-authkey.[domain] = [fingerprint].

Once your DNS records are in place, you can request your subdomain/domain from Serveo:

ssh -R subdomain.example.com:80:localhost:3000 serveo.net

When you request port forwarding for subdomain.example.com, Serveo will fetch the TXT records from your DNS server and only allow forwarding if you've provided a public key with the same fingerprint as specified in TXT records.