--- title: "Vast.ai Open Ports: How to Test and Expose Public Ports on GPU Hosts" description: "Learn how to check open ports on a Vast.ai host, test public reachability, expose SSH/API/dashboard ports, and avoid CGNAT or blocked inbound traffic." image: "https://needports.com/og-image.svg" canonical: "https://needports.com/vast-ai-open-ports.html" html: "https://needports.com/vast-ai-open-ports.html" --- # Vast.ai open ports: test and expose GPU host services Learn how to check open ports on a Vast.ai host, test public reachability, expose SSH/API/dashboard ports, and avoid CGNAT or blocked inbound traffic. ## Quick diagnosis checklist 1. Confirm the service is listening locally. 2. Confirm the service responds from the host itself. 3. Check host firewall rules before changing router rules. 4. Compare the host/router WAN address with the public IP seen by the internet. 5. Test from a different network, not from the same LAN. 6. If inbound traffic still times out, use a public forwarded endpoint instead of relying on upstream NAT. ## Commands to run first ``` # What public IPv4 does the internet see? curl -4 ifconfig.me # What is listening locally? ss -tulpen sudo ss -tulpen # Test a local web/API service curl -v http://127.0.0.1:8080 curl -v http://127.0.0.1:8000/health # Check common Linux firewalls sudo ufw status verbose sudo iptables -S sudo nft list ruleset ``` ## Setup example **YOUR_SETUP_TOKEN is shown after signup/trial checkout and binds the client to your assigned endpoint.** ``` curl -fsSL https://api.needports.com/install | sudo bash -s YOUR_SETUP_TOKEN --accept-tos sudo needports setup --dry-run sudo needports expose custom --public-port 30000 --local-port 8080 --name "Service" --confirm --restart curl -v http://your-needports-endpoint:30000 ``` ## Security notes - Expose only services you intend to make public. - Use SSH keys, HTTPS/TLS, app authentication, or IP restrictions where appropriate. - Never expose the Docker daemon socket or unauthenticated admin panels. - Keep a private fallback access method for critical systems. ## Related guides [CGNAT port forwarding](/cgnat-port-forwarding.html), [Vast.ai port forwarding](/vast-ai-port-forwarding.html), [NeedPorts client commands](/client-commands.html), and [NeedPorts security model](/security.html). ## FAQ **Why is my Vast.ai host online but not reachable?** The host may be able to make outbound connections while inbound traffic is blocked by CGNAT, upstream firewalling, Docker bind settings, or a local firewall. **Does Vast.ai always provide public inbound ports?** Not always. Your machine, ISP, datacenter, or rented network path may still prevent unsolicited inbound connections. **Can NeedPorts expose SSH for a Vast.ai host?** Yes, map an assigned public port to local SSH, then connect with ssh -p. Use SSH keys and avoid password-exposed root login. **Can I expose Docker services or APIs?** Yes. Expose the host port that Docker publishes locally, then test the public NeedPorts endpoint from outside. **Do I need router access?** No. NeedPorts uses an outbound tunnel, so it can work when router access or ISP port forwarding is unavailable. ## Deep troubleshooting examples ### Example 1: SSH works locally but public SSH times out This usually means the SSH daemon is healthy but the public network path is blocked. Confirm the daemon first, then test the public path from outside the host. ``` # On the host sudo ss -tulpen | grep ':22' systemctl status ssh || systemctl status sshd # From another machine, not the same LAN nc -vz your-public-host.example 22 ssh -vvv user@your-public-host.example ``` If local SSH is listening but the outside test times out, changing SSH keys will not fix the network path. Use a public forwarded port or fix the upstream firewall/NAT. ### Example 2: Docker publishes a port but renters cannot reach it Docker port publishing creates a host listener; it does not guarantee public internet reachability. Check the published host port, then map that host port to an assigned NeedPorts public port. ``` docker ps --format 'table {{.Names}} {{.Ports}}' ss -tulpen | grep 8080 curl -v http://127.0.0.1:8080 sudo needports expose custom --public-port 30001 --local-port 8080 --name "Docker Web UI" --confirm --restart curl -v http://your-needports-endpoint:30001 ``` ### Example 3: API binds to 127.0.0.1 Binding to localhost is not always a problem if the NeedPorts client runs on the same host and forwards to 127.0.0.1. It is a problem if Docker, the tunnel client, or another network namespace cannot reach the service. ``` # Local process bind check ss -tulpen | grep 8000 curl -v http://127.0.0.1:8000/health curl -v http://$(hostname -I | awk '{print $1}'):8000/health ``` If only localhost works, expose from the same host or adjust the service bind address intentionally. Do not bind sensitive admin panels publicly unless they have strong authentication. ## Before/after connection examples ### Before NeedPorts ``` $ nc -vz public-ip 8000 nc: connect to public-ip port 8000 (tcp) failed: timed out $ curl http://127.0.0.1:8000/health ok ``` ### After public forwarding ``` $ nc -vz your-needports-endpoint 30001 Connection to your-needports-endpoint 30001 port [tcp/*] succeeded! $ curl http://your-needports-endpoint:30001/health ok ``` ## When NeedPorts is not the right fix - The app is not running locally. - The app has no authentication and should not be public. - You only need private admin access between your own devices; a private mesh may be better. - You need CDN/WAF features for a public website; use a web/CDN platform. ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://needports.com/#organization", "name": "NeedPorts", "url": "https://needports.com/" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://needports.com/" }, { "@type": "ListItem", "position": 2, "name": "Guides", "item": "https://needports.com/guides.html" }, { "@type": "ListItem", "position": 3, "name": "Vast.ai Open Ports: How to Test and Expose Public Ports on GPU Hosts", "item": "https://needports.com/vast-ai-open-ports.html" } ] }, { "@type": "Article", "headline": "Vast.ai Open Ports: How to Test and Expose Public Ports on GPU Hosts", "description": "Learn how to check open ports on a Vast.ai host, test public reachability, expose SSH/API/dashboard ports, and avoid CGNAT or blocked inbound traffic.", "mainEntityOfPage": "https://needports.com/vast-ai-open-ports.html", "author": { "@id": "https://needports.com/#organization" }, "publisher": { "@id": "https://needports.com/#organization" } }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Why is my Vast.ai host online but not reachable?", "acceptedAnswer": { "@type": "Answer", "text": "The host may be able to make outbound connections while inbound traffic is blocked by CGNAT, upstream firewalling, Docker bind settings, or a local firewall." } }, { "@type": "Question", "name": "Does Vast.ai always provide public inbound ports?", "acceptedAnswer": { "@type": "Answer", "text": "Not always. Your machine, ISP, datacenter, or rented network path may still prevent unsolicited inbound connections." } }, { "@type": "Question", "name": "Can NeedPorts expose SSH for a Vast.ai host?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, map an assigned public port to local SSH, then connect with ssh -p. Use SSH keys and avoid password-exposed root login." } }, { "@type": "Question", "name": "Can I expose Docker services or APIs?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Expose the host port that Docker publishes locally, then test the public NeedPorts endpoint from outside." } }, { "@type": "Question", "name": "Do I need router access?", "acceptedAnswer": { "@type": "Answer", "text": "No. NeedPorts uses an outbound tunnel, so it can work when router access or ISP port forwarding is unavailable." } } ] } ] } ```