Skip to main content
Problem SolvedThis guide shows you how to receive Rhombus webhooks on servers behind firewalls or NAT without requiring a public IP address or complex VPN setup.
When working with webhook integrations, it’s common to require a publicly accessible endpoint. However, some environments—particularly on-premises or secured networks—do not allow direct public IP exposure. This guide walks through how to use reverse SSH tunneling to expose a webhook listener running on a private server.

Use Cases

This method is ideal for various scenarios where direct public access isn’t available or desired:

Security Requirements

Your server is behind a NAT/firewall and cannot have a public IP

Webhook Integration

You need to receive webhook POST requests from Rhombus

Secure & Simple

You want a secure way to forward traffic to your local webhook listener

Enterprise Networks

Corporate firewalls prevent direct inbound connections

Architecture Overview

How It WorksThe reverse SSH tunnel connects the public relay back to your local server, forwarding external traffic securely to your webhook listener.

Components

Step-by-Step Implementation

1

Provision a Public Relay Server

Set up a lightweight Linux server (e.g., Ubuntu) on a cloud provider like AWS, GCP, or DigitalOcean.Requirements:
  • Assign a public IP or domain name (e.g., relay.yourdomain.com)
  • Open inbound ports (80 or 443) for HTTP/HTTPS traffic
  • Minimal specs: 1 CPU, 512MB RAM is sufficient
AWS EC2 Setup
2

Configure SSH for Remote Tunneling

On the relay server, modify the SSH daemon configuration to allow remote port forwarding:
Edit SSH Config
Ensure the following options are set:
SSH Configuration
Security NoteThese settings allow remote port forwarding. Only enable on dedicated relay servers and secure with proper firewall rules.
Restart the SSH service:
Restart SSH
3

Set Up SSH Key Authentication

On your private server (where the webhook listener runs), generate SSH keys and copy them to the relay:
Generate SSH Keys
Verify passwordless SSH access:
Test Connection
Use a dedicated SSH key for the tunnel to make key rotation easier and improve security isolation.
4

Establish the Reverse SSH Tunnel

Run the following command on your private server:
Basic Reverse SSH Tunnel
Explanation:
  • 80 - External port exposed by the relay server
  • localhost:8080 - Your local webhook listener address
  • Connection stays active in foreground
5

Test the Setup

Now test that your tunnel is working correctly:
Test Webhook
Webhook URL for Rhombus:
Success IndicatorIf you see the request in your local webhook listener logs, the tunnel is working correctly!

Security Enhancements

HTTPS with NGINX

For production environments, add HTTPS support:
Install NGINX

Security Best Practices

Key-Based Authentication:
  • Use key-based SSH authentication only
  • Disable password authentication
  • Rotate SSH keys regularly
Secure SSH
Firewall Configuration:
  • Restrict traffic with firewall rules
  • Use fail2ban for SSH protection
  • Monitor tunnel connections
Firewall Rules
Restrict Access:
  • Limit SSH access to specific IPs when possible
  • Use non-standard SSH ports
  • Enable two-factor authentication for SSH
IP Restriction

Production Deployment

Systemd Service for Auto-Start

Create a systemd service to automatically start the tunnel on boot:
Create Service File
Systemd Service Configuration
Enable Service

Monitoring and Logging

Monitor Tunnel

Benefits of This Approach

Works Behind Firewalls

Functions perfectly behind NAT or corporate firewalls without any inbound rules

No VPN Required

Eliminates complex VPN setup and maintenance overhead

Easy Automation

Simple to automate with autossh and systemd for production reliability

Enterprise Safe

Fully outbound connection—safe for most enterprise network policies

Cost Effective

Uses minimal resources on a small cloud instance ($5-10/month)

Highly Reliable

Auto-reconnects and self-heals with proper configuration

Troubleshooting

Problem: Cannot establish SSH connection to relay serverSolutions:
Diagnose SSH Issues
Problem: Tunnel established but webhook requests don’t reach local serverSolutions:
Diagnose Tunnel Issues
Problem: Port 80 already in use on relay serverSolutions:
Resolve Port Conflicts
Problem: Tunnel disconnects regularlySolutions:
  • Use autossh instead of regular ssh
  • Add keep-alive settings to SSH config
  • Check network stability between servers
  • Increase timeout values
SSH Keep-Alive

Example Webhook Implementations

webhook-server.js
Installation:

Configuring Webhooks in Rhombus

Once your listener is running and tunnel is established:
1

Get Your Webhook URL

Your public webhook URL will be:
or with HTTPS:
2

Configure in Rhombus Console

  1. Log in to Rhombus Console
  2. Navigate to SettingsThird Party Integrations > Webhooks
  3. Click Add Webhook
  4. Enter your public webhook URL
  5. Select the events you want to receive
  6. Save configuration
3

Monitor Events

Watch your webhook server logs to see incoming events in real-time.

Next Steps

Success!You now have a secure, reliable way to receive Rhombus webhooks on your private infrastructure without exposing your servers to the internet or requiring complex VPN setups.

Rhombus Console

Configure webhooks in the Rhombus Console

Webhooks Overview

Learn about Rhombus webhook event types and payload formats

Developer Community

Join our community for webhook integration support
For production deployments: validate webhook signatures, use HTTPS, implement rate limiting, and maintain comprehensive logs of webhook events. Set up monitoring and alerts for webhook delivery failures.
Last modified on July 8, 2026