I am having an Android device and I want to connect in via 3G/4G and I am getting connection refused.

Any ideas how to do that?

  • 1
    Are you sure your device has a public IP address? The number of MNOs providing a public IPv4 per device is very very small and often limited to certain business or IoT contracts. Therefore most likely your device is behind a NAT gateway - therefore incoming connections are not possible.
    – Robert
    Commented Nov 17, 2018 at 15:31
  • 1
    Yes, it is behind NAT and I was hoping If there is a way to do this via reserve tunnel. Thanks Robert.
    – Garrie
    Commented Nov 17, 2018 at 16:30
  • Duplicate: android.stackexchange.com/q/89019/218526 Commented Jan 7, 2020 at 0:05

1 Answer 1


If you have a working SSH server running on Android device, you can connect to it on local/private network without any issues (after proper authentication setup obviously). Same may hold true for public network (internet) if your phone has a true public IP address (I don't think that happens on earth). However, when you need to cross networks i.e. traversing gateways and routers, there is Network Address Translation involved. You won't be able to access your device from internet if your SSH server can't be exposed to a public IP address.

In simple words, NAT is the translation of source IP from private address to public - routable; what they call it - address when an IP packet is leaving the router, so that packet could be sent back with identifiable IP address. Inverse happens when response for same packet is received back at router. It would mean mapping private IP of every host (phone, PC etc.) on local network to a unique public IP. But in usual cases, we just have one public IP assigned by ISP. So Port Address Translation comes in action. PAT translates every local IP address to same public IP address but with a unique port.

To address the problem of IP Address Shortage, Internet Service Providers also perform NAT, called Carrier Grade NAT. It means that IP address assigned by ISP to you isn't either a public but private IP address. This is a definite situation with Mobile Data i.e. on 3G/4G but less common with DSL connections.
If the IP assigned to your phone by ISP (you can check by ip address | grep inet command) is different from the one shown here, you are behind a CGNAT. Similarly for Wi-Fi router, IP address appearing under PPP Connection Settings should match with the public IP.

In order to maximum utilize the available pool of IP addresses, ISP's mostly assign dynamic IP address even when there is no CGNAT. So the public IP keeps on changing on daily, weekly, monthly or randomly basis, depending on the ISP's policy.

IPv6 is the upcoming protocol which won't need NAT and every network host on earth would be able to have a unique IP address.

Now coming to your question:

  • If there is no CGNAT, we can tackle the problem of DSL/3G/4G router's NAT by setting up Port Forwarding. But this option doesn't work if:

    • There is more than one hosts on local network that listen on same port (22 in case of ssh).
    • ISP firewalls don't allow you to receive incoming connections.
    • ISP locks you out of your router's Port Forwarding section or a 3G/4G router doesn't have a Port Forwarding settings at all.
  • Problem of Dynamic IP can be worked around by signing up a DDNS service. It assigns you a domain name that always resolves to your current public IP. DynuDNS is a free service that works perfect for me. You will have to install their software on your phone or PC to keep them updated of your public IP.

  • As far as CGNAT is concerned:
    • You can opt to buy a static public IP if your ISP provides this service but the price isn't "hearing friendly" in most cases.
    • Sign up for a service that lets you configure Port Forwarding on public VPN. There are free (for one port forwarding) solutions like portmap.io as well if you are not afraid of your traffic being sniffed :) Another specialized solution is ngrok that uses HTTP, TLS and TCP tunnels.
    • Setup a SSH (slower) or VPN (faster) tunnel from your phone to a personal server.
      • For best security and privacy, setup a self-owned server. You may use your broadband connection (if that has a public IP) for this purpose or may ask some friend to offer you this service.
      • Buy some trustworthy cloud VPS solution like AWS to host your personal SSH/VPN server. Setup is a bit technical but guides (1, 2) are available.

If you go with last option (setup a personal SSH or VPN server with public/static/dedicated IP address), follow the steps below to forward a specific port from SSH/VPN server to your phone:

  • SSH:

    With an SSH server setup, you can create Reverse Port Forwarding tunnel from your phone. Note that you can't forward remote server's (default SSH) port 22 to your phone's port 22 if you are connecting to the server on same port.

    Make sure GatewayPorts yes and AllowTcpForwarding yes are set in sshd_config on server, so that sshd allows port forwarding and accepts connections from public. Now on your phone create a reverse tunnel:

    ~$ ssh -NTR 2222:localhost:22 <server_user>@<server_ip>

    You can make ssh tunnel persistent using autossh or some app like ConnectBot if you want.

    For further options see this answer.

  • VPN:

    From your phone connect to the VPN server using a VPN app. When on a Virtual Private Network (VPN), both server and phone become part of a local network, so just apply iptables DNAT to forward the specific port to your phone's IP:

    ~# iptables -t nat -I PREROUTING -p tcp --dport 2222 -j DNAT --to <phone_ip>:22

    IP Forwarding is also required on server, which has probably been already set up during VPN server configuration:

    ~# echo 1 >/proc/sys/net/ipv4/ip_forward
    ~# iptables -I FORWARD -d <phone_ip> -j ACCEPT
    ~# iptables -I FORWARD -s <phone_ip> -j ACCEPT

Now you can ssh from any host on internet to your phone:

~$ ssh <phone_user>@<server_ip> -p 2222

You'll be logged in to your phone after authentication.

I explained here the SSH example. In the same way you can run any other server on your phone and forward its port from SSH/VPN server (with public IP) to your phone (with no public IP) so that your server becomes accessible from internet.


  • Just an addendum to the "VPN" section: Only the phone, the server is running on, have to use a VPN connection if the used VPN provides a public IP to the phone (often called static or dedicated IP). In such a case the client could use to the public IP offered by the VPN and reach the offered ssh service. There are public VPN providers offering such a VPN service.
    – Robert
    Commented May 20, 2020 at 17:59
  • 1
    @Robert sorry couldn't get the point. Can you elaborate? Commented May 20, 2020 at 18:07
  • 1
    You don't need two VPN connections. You wrote that they should be located in the same local network. But it doesn't have to be a local network, the Internet itself is also fine. If the serving device is located with a public IP in the Internet the second device don't needs a VPN connection.
    – Robert
    Commented May 20, 2020 at 18:14
  • @Robert got it. I couldn't explain it well I think. What I meant was that when two hosts are connected through VPN, they become part of a local network. E.g. if server's TUN interface has IP, the client would have something like So their routing/firewall has to be handled like if they are on a local network. // SSH and VPN servers both make sense only if they have a dedicated/public/static IP. Otherwise they won't be accessible to phone. Commented May 20, 2020 at 18:24
  • I know this is an old topic, but I have a new follow-up. I run my own DNS as well as the firewall on a server that I also totally control. I can easily configure a domain which is dynamically updated to always point to my device's public address. However, I believe that my cell provider does not provide incoming IP-based connectivity to their devices. So, is there some way I could run a proxy somehow between my Android device and the host that I control whereby I can make some sort of rsync connection to some address, and have it access data on my device via normal rsync conventions?
    – HippoMan
    Commented May 20, 2020 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .