Mac mini server remote access, from anywhere

The moment Mac mini server remote access stops working

Mac mini server remote access is easy right up until you leave the house. On the sofa, Screen Sharing finds the mini by name and ssh works first time. Then you are on a train, the site you host is down, and the address that worked at home times out. So you wait until you get back, and that is the whole reason the server exists: to not need you in the room.

The fix is not one setting, because remote access means three different things. Sometimes you want the screen, sometimes a terminal, and sometimes only the apps the mini serves. Each one crosses the same wall, but each one crosses it differently.

Three kinds of remote access, and which one you need

Decide which of these you actually want before touching a router, because the answer changes how much you have to expose.

• The screenYou want the macOS desktop itself: opening apps, clicking through a dialog, fixing something visual. This is Screen Sharing or a remote desktop app, and it is the heaviest thing to expose to the internet.
• The shellYou want a terminal on the server to restart a service, read a log, or pull a git repo. This is SSH, it is light, and it is the one most server work needs.
• The servicesYou want the things the mini serves: a website, Jellyfin on your phone, Home Assistant from the car. This needs no access to the Mac at all, only to a port, and that is the safest kind.

Start on the same network

Everything below assumes the local case already works, so make it work first. On the same Wi-Fi the mini answers to your-mini.local, and both doors open with one command each.

1. Turn on Remote Login in System Settings under General, then Sharing. That is the SSH server. It is off by default on every Mac.
2. Turn on Screen Sharing in the same list if you want the desktop. Leave it off if you only want a terminal.
3. From another Mac, run ssh you@your-mini.local. From Finder, choose Go, then Connect to Server, and enter vnc://your-mini.local.

sudo systemsetup -setremotelogin on

The wall between you and the mini

Home internet is built to download, not to be reached. Your router hands the mini a private address that means nothing outside the house. Your provider hands the router a public address that changes without warning. Increasingly, it does not hand out a real one at all.

That last case is carrier-grade NAT, and it is why port forwarding fails for a growing number of people. If your router's WAN address starts with 100. or 10., you are behind it, and no router setting will let an inbound connection in. You need a way through instead of a way in.

curl -4 ifconfig.me

Four ways through the wall

Each of these gets a connection from outside to the mini. They differ in what you expose, what you install, and what happens when your address changes.

• Forward a port and add dynamic DNSThe old way. Open port 22 on the router, point a DuckDNS or No-IP name at your changing address, and connect to that name. It works with a real public address, costs nothing, and puts an SSH port on the open internet where it will be guessed at all day. Keys only, never passwords.
• A mesh VPN such as TailscaleInstall it on the mini and on your laptop and phone. Each gets a stable private address that works from anywhere, including behind carrier-grade NAT, and nothing is exposed publicly. This is the right answer for the screen and the shell. It is the wrong answer for a website, because visitors do not have your VPN.
• A tunnel such as Cloudflare TunnelA small program on the mini holds a connection open to a provider, and the provider forwards traffic down it. Public services get a real address behind their network. You rely on the provider staying free for your use, and SSH through it needs their client on every machine you connect from.
• A relay built for thisThe same idea as a tunnel, with the server side handled for you: a public HTTPS address, a public SSH port with keys, and a panel that tells you when the mini has gone quiet. This is what MacServe does, and it is the one option on this list that also solves the next section.

Remote desktop to macOS without leaving it open

When you do need the screen, put it behind the VPN rather than a forwarded port. Screen Sharing over a Tailscale address is the same Screen Sharing you use at home, with nothing listening on the public internet.

SSH from anything you carry

Once a route exists, the terminal is the same from every device. Use a key rather than a password, keep the private half on the device you type on, and the rest is muscle memory.

• From a Mac or Linux laptopOpenSSH is built in. Put the host in ~/.ssh/config once and ssh mini is the whole command from then on.
• From WindowsWindows 10 and 11 ship OpenSSH too. Open PowerShell and the same ssh command works. PuTTY is no longer necessary, although it still works.
• From an iPhone or iPadTermius and Blink are the two clients worth paying for. Both store keys in the Secure Enclave, both survive a switch from Wi-Fi to mobile data, and both are enough to restart a service from a car park.

Host mini
  HostName 100.101.102.103
  User you
  IdentityFile ~/.ssh/id_ed25519
  ServerAliveInterval 30

Getting into a Linux server from a Mac: keys, config and the errors you will hit ↗

Why the mini stops answering while you are away

Every remote access setup fails the same three ways, and none of them is the network. The mini went to sleep, the mini rebooted and is waiting at the login screen, or the power went out and it never came back. Fix these before you trust the setup, because you will only find out about them when you are far away.

sudo pmset -a sleep 0 disksleep 0 autorestart 1

Keeping a Mac awake and online, in full ↗

What MacServe does about all of this

MacServe runs your server as a Linux machine inside the mini and handles the wall for you. It gives that server a public SSH port with keys, a public HTTPS address for anything you publish, and public TCP or UDP addresses for everything else. None of it needs a router setting, a static address, or a VPN on your phone.

It also answers the question you actually ask from the train: is it up? The panel shows whether the Mac is reporting in, whether Linux is running, and whether public access is on, and it lets you restart or stop the server from there. Headless mode installs a launch daemon, so the server comes back after a reboot with nobody logged in.

macserve enable-headless