How to Set Up a Persistent SSH Tunnel on Android Using Termux (No Root)

Before you start

Creating a reliable SSH tunnel on Android does not require rooting, but you do need a few basic conditions met. Preparing correctly saves time and avoids data‑loss or connectivity surprises later.

• Device requirements: Android 8.0 (Oreo) or newer. Older versions may lack the required OpenSSL libraries in Termux.
• Network access: A stable Wi‑Fi or mobile data connection that can reach the remote SSH server (port 22 or a custom port).
• Remote server: An SSH server with a user account you control and the ability to accept public‑key authentication.
• Battery & power: Keep the device plugged in or ensure at least 50 % charge. Persistent tunnels keep the network interface active, which can drain battery quickly.
• Permissions: Grant Termux storage permission (if you plan to store keys on external storage) via Settings > Apps > Termux > Permissions > Storage.

1. Install Termux and required packages

1. Open the Google Play Store (or F-Droid) and install Termux. The F-Droid version receives updates more frequently.
2. Launch Termux. The first run will download additional data – allow it to complete.
3. Update the package repository and upgrade existing packages:

   pkg update && pkg upgrade -y

4. Install the core tools needed for tunneling:

   pkg install openssh autossh curl -y

   • openssh provides ssh and ssh-keygen.
   • autossh automatically restarts the tunnel if the connection drops.
   • curl will be handy for quick connectivity checks.
5. Verify the installations:

   ssh -V
   autossh -V

   Both commands should print version information.

2. Generate or import SSH keys

A key pair is the most secure way to authenticate to your remote server. You can either generate a fresh pair inside Termux or copy an existing private key.

2.1 Generate a new key pair

1. Run the key generation command:

   ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519 -C "android@$(hostname)"

   • -t ed25519 creates a modern, compact key.
   • -a 100 sets a high number of KDF rounds, making brute‑force attacks harder.
   • -f defines the file name; we keep it in ~/.ssh/ which is the default location.
2. When prompted for a passphrase, enter a strong passphrase (or leave empty for automated tunnels). A passphrase adds security but requires you to unlock the key on each session start.
3. After the command finishes you will have two files:
   • ~/.ssh/id_ed25519 – private key (keep secret).
   • ~/.ssh/id_ed25519.pub – public key (share with the server).

2.2 Import an existing private key

1. Copy the private key file (e.g., id_rsa) from your PC to the Android device. The safest way is via a USB cable and adb push:

   adb push id_rsa /sdcard/Download/

2. In Termux, move the key to the proper location and set strict permissions:

   mv /sdcard/Download/id_rsa ~/.ssh/id_ed25519
   chmod 600 ~/.ssh/id_ed25519

3. If you have the matching public key, place it as ~/.ssh/id_ed25519.pub. Otherwise you can extract it:

   ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub

3. Add the public key to the remote server

Without the server recognising your public key, the tunnel will never authenticate.

1. On your PC (or any machine with SSH access), display the public key content:

   cat ~/.ssh/id_ed25519.pub

2. Log in to the remote server using a password or existing key.
3. Append the key to ~/.ssh/authorized_keys for the user you intend to tunnel as:

   echo "paste‑the‑key‑here" >> ~/.ssh/authorized_keys

4. Set proper permissions on the server side:

   chmod 600 ~/.ssh/authorized_keys
   chmod 700 ~/.ssh

Test the password‑less login from Termux:

ssh -i ~/.ssh/id_ed25519 user@your.server.com -p 22

If you are prompted for a passphrase only (or nothing at all), the key setup succeeded.

4. Install and configure autossh for a persistent tunnel

autossh monitors the health of the SSH connection and restarts it automatically. This is essential on mobile devices where network changes are frequent.

4.1 Choose the tunnel direction and ports

Typical use‑cases:

• Local port forwarding: Expose a remote service (e.g., a home‑lab web server) on your Android device as localhost:8080.
• Remote port forwarding: Make a service running on Android (e.g., a local web server) reachable from the remote side.

For this tutorial we’ll set up a local forward from the remote SSH server’s port 80 to Android’s localhost:8080. Adjust the numbers to suit your needs.

4.2 Create a wrapper script (optional but recommended)

Storing the full command in a script makes it easy to start/stop the tunnel and to add environment variables later.

cat > ~/start_tunnel.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/bash
# Autossh wrapper – keep the tunnel alive
# Replace user@host and ports as needed
AUTOSSH_PORT=0   # disables autossh’s monitor port (uses default)
export AUTOSSH_GATETIME=30   # seconds before autossh starts monitoring
autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" \
    -L 8080:127.0.0.1:80 \
    -i ~/.ssh/id_ed25519 user@your.server.com -p 22
EOF
chmod +x ~/start_tunnel.sh

Explanation of key flags:

• -M 0 disables the separate monitoring port; we rely on the built‑in keep‑alive options.
• -N tells SSH not to execute a remote command – we only want port forwarding.
• -o "ServerAliveInterval 30" sends a keep‑alive packet every 30 seconds.
• -o "ServerAliveCountMax 3" aborts after three missed keep‑alives, prompting autossh to restart.
• -L 8080:127.0.0.1:80 forwards remote port 80 to local port 8080.

4.3 Run the script in the background

Start the tunnel and detach it from the terminal so it survives after you close Termux:

nohup ~/start_tunnel.sh > ~/autossh.log 2>&1 &

Check that the process is running:

ps -ef | grep autossh

You should see a line containing autossh -M 0 -N …. The log file ~/autossh.log will contain any connection messages.

5. Verify the tunnel works

Assuming the remote server hosts a web page on port 80, you can now access it locally:

curl http://127.0.0.1:8080

If you receive the HTML of the remote site, the tunnel is functional. You can also open a browser on Android and navigate to http://127.0.0.1:8080.

For remote‑forward scenarios, try connecting from the remote machine to the Android‑exposed port using the same ssh -R syntax.

Troubleshooting

• Connection immediately drops: Check that the server’s SSH daemon allows the chosen authentication method. Look at ~/autossh.log for messages like “Permission denied”.
• No traffic passes through the tunnel: Verify the port numbers. Use netstat -tuln | grep 8080 on Android (install net-tools if needed) to confirm the local listener exists.
• Autossh restarts endlessly: The remote side may be closing idle connections. Increase ServerAliveInterval to 60 seconds or add -o "TCPKeepAlive yes".
• Battery drains quickly: Disable the tunnel when not needed. You can stop it with pkill autossh or by killing the specific PID.
• Android kills the process in the background: Some OEMs have aggressive task‑killer policies. Add Termux to the device’s battery‑optimization whitelist: Settings > Battery > Battery optimization > All apps > Termux > Don’t optimize.

Safety and privacy considerations

• Never share your private key file. If you suspect it’s been compromised, delete ~/.ssh/id_ed25519 and generate a new pair.
• When using a passphrase‑protected key, you’ll need to unlock it each time the tunnel starts. Consider using ssh-agent inside Termux to cache the decrypted key for the session.

  eval $(ssh-agent -s)
  ssh-add ~/.ssh/id_ed25519

• Be aware that any traffic forwarded through the tunnel travels unencrypted beyond the SSH endpoint. Only forward services you trust.

With the tunnel in place, you now have a secure bridge from your Android device to any remote service that accepts SSH connections. The same pattern can be adapted for database ports, VNC, or even SOCKS5 proxying by changing the -L or -D arguments.

Enjoy the flexibility of a persistent SSH tunnel—no root required, and fully under your control.