How to Use VS Code Remote Tunnels Without SSH

VS Code Remote Tunnels let you connect to a remote machine from any VS Code client without setting up SSH, opening firewall ports, or configuring a VPN. You run one command on the remote machine, open a URL on your client, and start coding as if you were sitting at the remote desktop.

Tunnels use the Microsoft dev tunnels service. VS Code makes outbound connections to Azure and does not open a network listener, so firewall changes are generally unnecessary.

What you need

On the remote machine, you need a GitHub or Microsoft account and VS Code or the standalone code CLI. On the client side, use a browser or VS Code with the Remote - Tunnels extension. Authenticate both ends with the same account.

Method 1: Start a tunnel with the code CLI

This method works on any machine that can run the code command, including headless Linux servers.

On the remote machine, open a terminal and run:

bash

code tunnel

If you are using the standalone CLI instead of the full VS Code install, use ./code tunnel from the directory where you extracted it.

The first time, review and accept the server license terms. The CLI uses a browser or device-code sign-in flow, so a headless remote can be authorized from another device.

After authentication, the CLI starts the VS Code Server and prints a URL. Open this URL on any client machine and sign in with the same GitHub account. VS Code opens in the browser, connected to your remote machine.

Method 2: Start a tunnel from the VS Code UI

If the remote machine already has VS Code Desktop running, use the UI:

You can also open the Command Palette and run Remote Tunnels: Turn on Remote Tunnel Access....

The tunnel stays active as long as VS Code remains open on the remote machine. Closing VS Code stops the tunnel.

Connecting from a client

You have three ways to connect to an active tunnel:

From a browser: Open the vscode.dev URL from the CLI output or the VS Code notification. This opens the full VS Code web editor connected to your remote machine.

From VS Code Desktop: Install the Remote - Tunnels extension. Open the Command Palette and run Remote Tunnels: Connect to Tunnel. Pick your machine from the list. You can also open the Remote Explorer and find your machine under Tunnels.

From the Remote Explorer: The Remote Explorer in the Activity Bar shows all your active tunnels. Right-click a machine and select Connect in Current Window or Connect in New Window.

Once connected, the Status Bar shows the remote machine name. You can open folders, edit files, run terminals, and debug as if you were local.

Running a tunnel as a background service

To keep the tunnel available independently of an interactive terminal, install it as a system service with code tunnel service install. This changes system service configuration and may request elevated privileges, so use it only on a machine you administer.

When you no longer need persistent access, remove the service with code tunnel service uninstall. Test the connection after a restart if reboot persistence is required for your workflow.

You can also pass --no-sleep to prevent the remote machine from sleeping while the tunnel is active:

bash

code tunnel --no-sleep

Security and limits

Tunnels are encrypted end-to-end. After the initial HTTPS connection to Azure, an SSH session is established over the tunnel using AES 256 CTR mode. Only your authenticated account can access your tunnels.

Key facts about the tunneling service:

• Account limit: The current documented limit is 10 registered tunnels per account and is subject to change. At the limit, the CLI can delete a random unused tunnel when it creates another.
• Authentication: The same GitHub or Microsoft account must be used on both the remote machine and the client.
• Single user: Only one client can connect to a tunnel at a time.
• No inbound ports: All connections are outbound. You do not need to configure firewalls or open ports.

Removing a tunnel

To stop a tunnel started from the CLI, press Ctrl+C in the terminal. To stop one started from the VS Code UI, run Remote Tunnels: Turn off Remote Tunnel Access... from the Command Palette.

To permanently remove a machine from your tunneling account, run code tunnel unregister on that machine. You can also right-click the machine in the Remote Explorer and select Unregister.

Combining tunnels with other remote features

Once connected through a tunnel, you can layer other remote extensions:

• Open a WSL distribution on the remote Windows machine
• Reopen the folder in a Dev Container if Docker is installed on the remote machine

This means you can tunnel to a powerful desktop and then open a Dev Container inside that machine, all from a lightweight laptop or tablet.

Troubleshooting

The vscode.dev URL does not load. Make sure both the remote machine and your client have outbound HTTPS (port 443) access. The tunnel requires connectivity to global.rel.tunnels.api.visualstudio.com. If your organization blocks this domain, ask your IT admin to allow it.

"Tunnel not found" when connecting. The tunnel may have been stopped or the machine went to sleep. On the remote machine, restart the tunnel with code tunnel. For persistent access, install the service with code tunnel service install.

Authentication fails on a headless server. Use the device code flow. When prompted to log in, the CLI prints a URL and a code. Open the URL on any device with a browser, enter the code, and authenticate. The CLI detects the completed authentication and proceeds.

Next, learn how to connect to a remote server with SSH when SSH is available, or open a GitHub repository without cloning for quick code browsing.