> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hologram.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Establish a secure Spacebridge tunnel to a device using SSH

> Enable tunneling, upload an SSH key, and open a Spacebridge tunnel using port forwarding.

Hologram Spacebridge lets you create authenticated SSH tunnels to devices on the Hologram cellular network.

## Enable secure device tunneling

You can enable tunneling for a single SIM or for multiple SIMs from the Dashboard.

<Note>
  **Note:** You must configure your device's network interface to support inbound connections.
</Note>

## Generate an SSH key and upload to the API

You only need to complete this section the first time you're setting up the tunnel on this computer. If you already have an SSH key-pair that you'd like to use, skip to step 2.

<Steps>
  <Step title="Generate an SSH key-pair">
    Use `ssh-keygen` to generate a SSH key-pair:

    ```bash theme={null}
    ssh-keygen -f spacebridge.key -b 4096 -t rsa
    ```
  </Step>

  <Step title="Upload the public key to the API">
    Upload your public key to the Hologram API. In the code below, replace **`~APIKEY~`** with your Hologram API key. Your personal API can be found in your dashboard by clicking on the **Settings** section in the main menu, opening the **My account** tab, and scrolling to the **API** card. If you are using a key that you already generated, replace the filename in the export command.

    The filename ends in **`.pub`**, not `.key`. If you use the `.key` file this will upload your private key which you don't want to do.

    ```bash theme={null}
    PUBKEY=$(cat spacebridge.key.pub)
    curl -X POST \
      -H "Content-Type: application/json" \
      -u apikey:YOUR_HOLOGRAM_API_KEY \
      -d '{"public_key":"'"$PUBKEY"'"}' \
      "https://dashboard.hologram.io/api/1/tunnelkeys?apikey=~APIKEY~"
    ```

    The same command can also be run with Powershell in Windows:

    ```powershell theme={null}
    $pub = (Get-Content .\spacebridge.key.pub -Raw).Trim(); Invoke-RestMethod -Uri "https://dashboard.hologram.io/api/1/tunnelkeys?apikey=YOUR_HOLOGRAM_API_KEY" -Method Post -ContentType "application/json" -Body (@{public_key = $pub} | ConvertTo-Json)
    ```
  </Step>
</Steps>

You should get a successful response back. Users can have up to 5 active device tunneling keys (to enable or disable keys follow these instructions).

## Open the tunnel with SSH port forwarding

<Steps>
  <Step title="Find your SIM's link (profile) ID">
    Look up the link (profile) ID for the SIM you are trying to tunnel into. In your dashboard you can find this number by navigating to the SIM's details page and opening the **Profiles** tab.
  </Step>

  <Step title="Open the tunnel with SSH port forwarding">
    The command below will open up the tunnel. You can see in this command where you would replace the link ID (999999) with your own ID. In this case, port `22` is the port on the device, and port `5000` is the local port being forwarded. Replace `spacebridge.key` with whatever private key you are using. This should be key file that goes with the `.pub` file that you uploaded to the Hologram API.

    ```bash theme={null}
    ssh -p 999 -L 5000:link999999:22 -N -i spacebridge.key htunnel@tunnel.hologram.io -v
    ```
  </Step>

  <Step title="Connect over SSH">
    You should now be able to connect to port `22` on your device from port `5000` on the local host (example here).
  </Step>
</Steps>

## Related actions

<Card title="Enable/disable tunneling keys via API" href="/guides/communication/enable-and-disable-device-tunneling-keys-using-the-rest-api" horizontal />

<Card title="View tunneling keys via API" href="/guides/communication/view-device-tunneling-keys-using-the-rest-api" horizontal />