Problem SolvedThis guide shows you how to receive Rhombus webhooks on servers behind firewalls or NAT without requiring a public IP address or complex VPN setup.
Use Cases
This method is ideal for various scenarios where direct public access isn’t available or desired:Security Requirements
Your server is behind a NAT/firewall and cannot have a public IP
Webhook Integration
You need to receive webhook POST requests from Rhombus
Secure & Simple
You want a secure way to forward traffic to your local webhook listener
Enterprise Networks
Corporate firewalls prevent direct inbound connections
Architecture Overview
How It WorksThe reverse SSH tunnel connects the public relay back to your local server, forwarding external traffic securely to your webhook listener.
Components
Step-by-Step Implementation
1
Provision a Public Relay Server
Set up a lightweight Linux server (e.g., Ubuntu) on a cloud provider like AWS, GCP, or DigitalOcean.Requirements:
- Assign a public IP or domain name (e.g.,
relay.yourdomain.com) - Open inbound ports (80 or 443) for HTTP/HTTPS traffic
- Minimal specs: 1 CPU, 512MB RAM is sufficient
- AWS EC2
- DigitalOcean
- Google Cloud
AWS EC2 Setup
2
Configure SSH for Remote Tunneling
On the relay server, modify the SSH daemon configuration to allow remote port forwarding:Ensure the following options are set:Restart the SSH service:
Edit SSH Config
SSH Configuration
Restart SSH
3
Set Up SSH Key Authentication
On your private server (where the webhook listener runs), generate SSH keys and copy them to the relay:Verify passwordless SSH access:
Generate SSH Keys
Test Connection
4
Establish the Reverse SSH Tunnel
Run the following command on your private server:Explanation:
- Basic Tunnel
- Background Process
- Persistent Tunnel
Basic Reverse SSH Tunnel
80- External port exposed by the relay serverlocalhost:8080- Your local webhook listener address- Connection stays active in foreground
5
Test the Setup
Now test that your tunnel is working correctly:Webhook URL for Rhombus:
Test Webhook
Success IndicatorIf you see the request in your local webhook listener logs, the tunnel is working correctly!
Security Enhancements
HTTPS with NGINX
For production environments, add HTTPS support:- NGINX Setup
- SSL Certificate
- Configuration
Install NGINX
Security Best Practices
Authentication
Authentication
Key-Based Authentication:
- Use key-based SSH authentication only
- Disable password authentication
- Rotate SSH keys regularly
Secure SSH
Network Security
Network Security
Firewall Configuration:
- Restrict traffic with firewall rules
- Use fail2ban for SSH protection
- Monitor tunnel connections
Firewall Rules
Access Control
Access Control
Restrict Access:
- Limit SSH access to specific IPs when possible
- Use non-standard SSH ports
- Enable two-factor authentication for SSH
IP Restriction
Production Deployment
Systemd Service for Auto-Start
Create a systemd service to automatically start the tunnel on boot:Create Service File
Systemd Service Configuration
Enable Service
Monitoring and Logging
Monitor Tunnel
Benefits of This Approach
Works Behind Firewalls
Functions perfectly behind NAT or corporate firewalls without any inbound rules
No VPN Required
Eliminates complex VPN setup and maintenance overhead
Easy Automation
Simple to automate with autossh and systemd for production reliability
Enterprise Safe
Fully outbound connection—safe for most enterprise network policies
Cost Effective
Uses minimal resources on a small cloud instance ($5-10/month)
Highly Reliable
Auto-reconnects and self-heals with proper configuration
Troubleshooting
SSH Connection Fails
SSH Connection Fails
Problem: Cannot establish SSH connection to relay serverSolutions:
Diagnose SSH Issues
Tunnel Not Working
Tunnel Not Working
Problem: Tunnel established but webhook requests don’t reach local serverSolutions:
Diagnose Tunnel Issues
Port Already in Use
Port Already in Use
Problem: Port 80 already in use on relay serverSolutions:
Resolve Port Conflicts
Connection Drops Frequently
Connection Drops Frequently
Problem: Tunnel disconnects regularlySolutions:
- Use
autosshinstead of regularssh - Add keep-alive settings to SSH config
- Check network stability between servers
- Increase timeout values
SSH Keep-Alive
Example Webhook Implementations
- Node.js
- Python
- C#
- Go
webhook-server.js
Configuring Webhooks in Rhombus
Once your listener is running and tunnel is established:1
Get Your Webhook URL
Your public webhook URL will be:or with HTTPS:
2
Configure in Rhombus Console
- Log in to Rhombus Console
- Navigate to Settings → Third Party Integrations > Webhooks
- Click Add Webhook
- Enter your public webhook URL
- Select the events you want to receive
- Save configuration
3
Monitor Events
Watch your webhook server logs to see incoming events in real-time.
Next Steps
Success!You now have a secure, reliable way to receive Rhombus webhooks on your private infrastructure without exposing your servers to the internet or requiring complex VPN setups.
Rhombus Console
Configure webhooks in the Rhombus Console
Webhooks Overview
Learn about Rhombus webhook event types and payload formats
Developer Community
Join our community for webhook integration support
For production deployments: validate webhook signatures, use HTTPS, implement rate limiting, and maintain comprehensive logs of webhook events. Set up monitoring and alerts for webhook delivery failures.