Written 25 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Keep the leftover box on the house network

SSH and Pi-hole belong on the house network. Skip this if you never opened the router settings. Do not forward port 22.

SSH and Pi-hole belong on the house network only. The leftover box should not have a public address. A public address is a number the whole internet can knock on. The leftover box already has a house number. That is enough.

Skip this if you never opened the router

If you never opened the router settings, you already did this. Plugging a cable into a LAN port, not WAN, is a cable beats Wi-Fi for the leftover box. SSH from the couch already says do not forward port 22. Come back only if a forum told you to open a port, or to put the leftover box in the DMZ.

What a port forward is

A port forward is a hole in the house router that lets the whole internet knock on the leftover box. The usual bad advice is "forward 22 so I can SSH from work." Do not do that on a leftover box with a password login. Anyone on the internet can try that password. SSH from the couch still works without the hole. DMZ is worse: it puts the whole leftover box on the open internet, not just one port.

A thirty-second check

Open the house router page. The address is often printed on the sticker: 192.168.0.1 or 192.168.1.1. Look for Port forwarding, Virtual server, or DMZ. If those lists are empty, you are done. You do not need a command for this.

If you already forwarded 22

Turn that rule off. Then SSH still works from the couch, on house Wi-Fi or a cable. That is SSH from the couch, with the number from find the leftover box on the house network.

Remote access can wait

Remote access is a later problem. This leftover box is for the house. A VPN or a "cloud tunnel" is later, and usually never.

What next

If the leftover box is still on Wi-Fi, plug a cable: a cable beats Wi-Fi for the leftover box. If you are done for the night, shut down the leftover box without yanking the plug. Do not buy a NAS. Do not buy a new router.

Skip

Skip this note if you never opened the router settings. Skip forwarding port 22. Skip putting the leftover box in the DMZ. Skip a new router, a firewall appliance, and a VPN this pass.

Sources

Ubuntu Server: OpenSSH server. Debian: ssh man page. Official pages only. For the leftover box, see start with what you already have. For the login, see SSH from the couch. For the cable, see a cable beats Wi-Fi for the leftover box.

Also on this topic

SSH from the couchType commands on the leftover box from your laptop, on the house network. Password login first. Do not open this to the internet. A cable beats Wi-Fi for the leftover boxOnce the leftover box is doing real work, plug it into the router with a cable. House Wi-Fi can wait. Skip this if it is already on a cable. Find the leftover box on the house networkThe leftover box has a number on your house network. You need that number to SSH from the couch. You do not need a new router. Shut down the leftover box without yanking the plugWhen you are done for the night, tell the leftover box to finish writing, then power off. Do not yank the cord. Skip this if you only need a reboot after updates.