Written 9 Sep 2026. This is a how-to, not a product card.

Away SSH is not day one

SSH from the couch on the house network first. A café cannot see 192.168.x. Don't forward port 22. A mesh VPN is later.

If SSH from the laptop on house Wi-Fi still fails, stop. That walk is SSH from the couch. Away access is a later luxury. It is not a reason to punch a hole in the router.

Why the café fails

The leftover box lives behind NAT. The house shares one public address. Inbound SSH is dropped. That is NAT is why SSH stays inside. A forwarded 22 makes every scanner a guest. Don't.

Later

When house SSH is boring, a mesh VPN (Tailscale and friends) gives a 100.x hop without a router hole. The how-to when you actually leave the house is SSH from away. Write the house name first: write the house name in Lab plan.

What next

House login: SSH from the couch. Boundary: keep it on the house network. Tick Plan after the couch login works. Not after a quiz.

Optional: house vs café vs later mesh as a sandbox in ByteRush — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

• Skip forwarding port 22.
• Skip Tailscale on day one.
• Skip a new firewall appliance for this.