SSH from your phone without opening port 22: Termius + Tailscale
Use Tailscale to keep SSH off the public internet, then connect from your phone with Termius on iOS or Android. Tailscale creates a virtual private network (VPN) based on WireGuard, so you do not need to expose port 22.
The awkward part is cellular data. A silent network drop can leave the SSH session hanging even though the connection is gone.
The fix is in Termius, not Tailscale. A couple of session settings help detect mobile-network drops sooner.
Stop Termius sessions hanging on cellular
A cell tower handoff or carrier NAT cleanup can kill an SSH session without closing it cleanly.
Enable Experimental Connection Process and reduce the Keepalive Interval to 500:
- Go to Profile, then Settings.
- Under Sessions, enable Experimental Connection Process.
- Set Keepalive Interval lower than the default. A value of
500worked in testing. - Leave Expect answer available enabled. This makes Termius send keepalive probes and detect missing server responses sooner.
Why this helps
A more frequent keepalive makes Termius send control packets more often. This keeps carrier NAT state active longer and detects a non-responsive server sooner. In my testing, the Experimental Connection Process also helped connection setup through VPNs and mobile networks.
What it cannot do
These settings cannot recover a fully broken SSH session. They only help with short cellular interruptions, making Termius over Tailscale less likely to hang.
Related links
Frequently asked questions
- How can I SSH from a phone without exposing port 22?
- Use Tailscale to reach your servers through a private WireGuard network, then connect with Termius on iOS or Android. Port 22 does not need to be open to the public internet.
- Why can Termius disconnect over Tailscale on cellular data?
- A cell tower handoff or carrier NAT cleanup can silently kill an SSH session. A more aggressive keepalive in Termius helps keep the tunnel open.
- How do I stop Termius SSH sessions dropping on cellular data?
- Open Profile, Settings, Sessions in Termius. Enable 'Experimental Connection Process' and reduce 'Keepalive Interval' to 500. You do not need to change anything in Tailscale.
- What Keepalive Interval should I use?
- A value of 500 kept sessions active in testing because Termius sent control packets more often.
- Does this setup expose SSH port 22 to the public internet?
- A public port 22 is not required. Check the server firewall and listening addresses separately, because this guide does not replace a network exposure test.