🛠 Accès distant sans VPN : enregistrer un CM5 dans Raspberry Pi Connect

Objectives

A CM5 often ends up in a product: wall-mounted enclosure, technical cabinet, customer kiosk. Opening ports or setting up a VPN is then unacceptable. Raspberry Pi Connect, the official service, reverses the model: the CM5 initiates an encrypted outbound connection to the service, and you then connect from the browser or app — zero port forwarding, zero public IP. This tutorial covers installing the daemon, associating the device with your account, opening a remote SSH terminal, and verifying on the CM5 side that no ports are listening.

Hardware

• 1 × CM5 on a CM5IO Board, up-to-date 64-bit Raspberry Pi OS, connected to the Internet (Ethernet or Wi-Fi depending on SKU)
• A Raspberry Pi account (free) and a second device for testing (phone or another PC)
• SSH enabled on the CM5 (via raspi-config or Imager pre-configuration)

Complete code

# 1) Installer le démon officiel Raspberry Pi Connect
curl -fsSL https://connect.raspberrypi.com/install -sSf | sudo sh

# 2) Configurer et associer l'appareil (une URL s'affiche à ouvrir dans le navigateur)
sudo raspberry-pi-connect configure

# 3) Vérifier le service
systemctl status raspberry-pi-connect --no-pager | head -6
journalctl -u raspberry-pi-connect -n 10 --no-pager

# 4) Depuis un autre appareil : ouvrir raspberryconnect.com dans un navigateur,
#    sélectionner l'appareil en ligne et lancer un terminal SSH.

# 5) Côté CM5, prouver qu'aucun port n'est exposé au monde :
sudo ss -tulpn | grep LISTEN

Expected verification

The device appears as “online” on the Raspberry Pi Connect dashboard; the remote terminal opens a real SSH session on the CM5; ss -tulpn shows only locally listening services (no port 22 open on the public interface — this is the whole point of the outbound model). After sudo reboot, the device comes back online in less than a minute.

Common errors

• SSH disabled in the OS: Connect relies on sshd; without sudo raspi-config → Interface Options → SSH, the remote session will fail.
• Expired association URL: The link displayed by configure is single-use and temporary; rerun configure if the account has never been linked.
• Confusing it with a VPN: Connect does not create a network — it proxies sessions (SSH, file) to the device; no mDNS broadcasting or access to other machines on the remote LAN.
• Corporate outbound firewall: The CM5 must be able to make outbound HTTPS/WSS connections to the service; in restricted networks, plan for testing before deployment.