SSH to any machine without an IP address, behind a NAT/firewall without port forwarding or VPN setup.
# on the server
> pigeons roost
roost is running! id: bb8e1a5661a6dfa9ae2dd978922f30f524f6fd8c99b3de021c53f292aae74330
# on the client — add a route, then ssh as normal
> pigeons add --id bb8e1a5661a6dfa9ae2dd978922f30f524f6fd8c99b3de021c53f292aae74330 --name my-server
> ssh user@my-serverThat's it. (requires ssh/sshd to be installed)
Download the binary for your operating system from GitHub Releases, or use our bash one-liner:
curl -fSsL https://vorc.s3.us-east-2.amazonaws.com/pigeons-install.sh | bashStart a roost to accept incoming connections. Keys are persisted by default so the endpoint ID stays the same across restarts:
> pigeons roost
roost is running! id: bb8e1a5661a6dfa9ae2dd978922f30f524f6fd8c99b3de021c53f292aae74330Use --ephemeral for a throwaway identity, or --ssh-port if sshd is on a non-standard port:
> pigeons roost --ephemeral --ssh-port 2222The easiest way to connect is to add a pigeon route, which creates an SSH config entry:
> pigeons add --id bb8e1a5661a6dfa9ae2dd978922f30f524f6fd8c99b3de021c53f292aae74330 --name my-server
Pigeon route 'my-server' added to ~/.ssh/configThen connect with standard ssh:
> ssh user@my-serverWorks through any firewall, NAT, or private network. No configuration needed.
Install pigeons as a system service for always-on access:
> pigeons service install # default SSH port 22
> pigeons service status # check if the service is running
> pigeons service log # view service logs
> pigeons service uninstall # remove the serviceSupported on Linux (systemd), macOS (launchd), and Windows (SCM).
# Add a route
> pigeons add --id <ENDPOINT_ID> --name my-server
# List configured routes
> pigeons list
# Remove a route
> pigeons remove my-server┌─────────────┐ ┌─────────────────┐ ┌─────────────┐
│ SSH │─────────▶│ QUIC Tunnel │─────────▶│ pigeons │
│ Client │ │ (P2P Network) │ │ roost │
└─────────────┘ └─────────────────┘ └─────────────┘
│ ▲ │
│ │ │
▼ │ ▼
┌─────────────┐ ┌─────────────────┐ ┌──────────────────┐
│ ProxyCommand│ │ pigeons fly │ │ SSH Server │
│ pigeons fly │─────────▶│ --stdio │ │ localhost:22 │
│ --stdio │ │ │ └──────────────────┘
└─────────────┘ └─────────────────┘
- SSH Client: Invokes
pigeons fly --stdiovia SSH's ProxyCommand - Fly: Establishes QUIC connection through Iroh's P2P network (automatic NAT traversal)
- Roost: Accepts connection and proxies to local SSH daemon (port 22)
- Authentication: Standard SSH authentication end-to-end over encrypted QUIC tunnel
# Server
> pigeons roost # start a roost (persistent keys by default)
> pigeons roost --ephemeral # throwaway identity
> pigeons roost --ssh-port 2222 # custom SSH port
# Client
> pigeons fly <ENDPOINT_ID> # quick connect (binds local port)
> pigeons fly --stdio <ENDPOINT_ID> # ProxyCommand mode (used by ssh config)
> pigeons add --id <ID> --name <NAME> # add SSH config entry
> pigeons list # list pigeon routes
> pigeons remove <NAME> # remove SSH config entry
# Service
> pigeons service install # install as system service
> pigeons service install --ssh-port 2222 # with custom SSH port
> pigeons service status # check service status
> pigeons service log # view service logs
> pigeons service uninstall # remove service- Endpoint ID access: Anyone with the Endpoint ID can reach your SSH port
- SSH authentication: Standard SSH auth (keys, certificates, passwords) applies
- Persistent keys: Uses dedicated
.ssh/pigeons_ed25519keypair - QUIC encryption: Transport layer encryption between endpoints
Licensed under either of Apache License 2.0 or MIT license at your option.