The P2P Bridge for Seamless SSH Anywhere

Bifrost is a high-performance, P2P-powered SSH tunneling tool built with Rust and Iroh. It allows you to access remote servers via SSH even if they are behind strict NATs, firewalls, or lack a public IP—no port forwarding or complex VPNs required.

Key Features • How It Works • Installation • Getting Started • Security

---

✨ Key Features

• 🚀 Zero Configuration Networking: Connect through CGNATs and firewalls without port forwarding.
• 🔒 End-to-End Encrypted: Built on top of Iroh's secure P2P protocol with QUIC.
• 🔑 Token-Based Authentication: Simple and secure access control for your bridge.
• 🛰️ P2P Direct Connections: Faster latency by establishing direct peer-to-peer links whenever possible.
• 🛠️ Seamless SSH Integration: Works as an SSH ProxyCommand, supporting ssh, scp, rsync, and more.
• ⚡ Native Performance: Written in Rust for maximum speed and minimal resource usage.

---

🏗️ How It Works

Bifrost consists of two lightweight components:

1. bifrost-d (The Daemon): Runs on your remote server. It creates an Iroh node with a persistent identity and listens for tunnel requests. When a authorized connection arrives, it bridges the traffic to the local SSH daemon (port 22).
2. bifrost-c (The Client): Runs on your local machine. It connects to the daemon using its unique Node ID and handles the authentication handshake, piping your SSH session through the secure P2P tunnel.

---

📦 Installation

From Source

Ensure you have Rust and Cargo installed.

# Clone the repository
git clone https://github.com/yourusername/bifrost.git
cd bifrost

# Build the project
cargo build --release

The binaries will be available in target/release/bifrost-d and target/release/bifrost-c.

---

🚀 Getting Started

1. Server Setup (bifrost-d)

On the remote machine you want to access:

./target/release/bifrost-d --token YOUR_SECRET_TOKEN --key-path ./bifrost.key

• Record the Node ID printed on startup.
• You can run this as a systemd service (see the provided bifrost.service template).

2. Client Setup (bifrost-c)

On your local machine, use the setup command to automatically configure your SSH config:

./target/release/bifrost-c setup \
    --node-id SERVER_NODE_ID \
    --token YOUR_SECRET_TOKEN \
    --name my-remote-server \
    --user username

3. Connect!

Now you can SSH into your remote server as if it were local:

ssh my-remote-server

You can also use it for file transfers:

scp ./local-file.txt my-remote-server:/tmp/

---

🛡️ Security

• Iroh Security: All traffic is encrypted using Iroh's underlying QUIC implementation.
• Access Tokens: Even if someone knows your Node ID, they cannot establish a bridge without the correct bearer token.
• SSH Logic: Bifrost only handles the transport. You still use your standard SSH keys/passwords for the final authentication to the server, providing two layers of security.

---

🛠️ Tech Stack

• Iroh: Peer-to-peer networking and NAT traversal.
• Tokio: Asynchronous runtime for high-concurrency IO.
• Clap: Robust command-line argument parsing.
• Anyhow: Flexible error handling.

---

Built with ❤️ using Rust