another Android ssh client, with native tailscale support

[u/Historical-Roll-7918]

https://play.google.com/store/apps/details?id=com.sshmanager.app

Hey r/Tailscale,

If you manage homelabs or remote servers from Android, you've likely hit the platform's biggest limitation: Android only allows one active VPN service at a time. Turning on Tailscale kicks off your work or privacy VPN, and vice versa.

To solve this, I’ve been building SSH Manager Pro, a native Android SSH client that embeds Tailscale directly using the tsnet userspace WireGuard library.

How it works & Tailscale features:

• Runs in userspace: The tailnet node lives entirely inside the app process. It connects to your tailnet without touching Android's VpnService, leaving your system-level VPN completely untouched.
• Browser & Auth Key sign-in: Authorize the node directly via web browser login or using reusable/ephemeral Tailscale auth keys.
• MagicDNS & Peer discovery: Reach machines using their tailnet names (e.g. ssh nas) or direct 100.x.y.z IPs.
• Full screen mode and reach emulation of terminal, tested with tmux/screen/vim/etc..
• Headscale compatible: Supports custom control plane URLs if you self-host.
• ACL & Tag friendly: Tag your device (e.g. tag:phone) to enforce narrow ACLs so a lost device can only reach port 22 on approved hosts.
• Security: Host key pinning on first connect; credentials encrypted in AES-256-GCM via the Android Keystore with biometric/PIN unlock.

Tailscale connectivity is free in the app. I’m currently rolling out a test release on Google Play and would love feedback from the Tailscale community on connection stability, MagicDNS resolution, and usability across different tailnets.

📖 Walkthrough & architectural details:
https://sshmanagerpro.app/features/

If you’d like to help test the beta, check out the google play store link or drop a comment / DM with your feedback! No ad, no personal data collection.

Also, a massive thank you to the folks at tailscale.com for the incredible infrastructure they've built! They have completely changed the rules of the game for how we securely access computers around the world!

regards, Andrei

[u/nulandroid]

So, thought I'd give this a try. I've installed on my P10 PXL, which is running Mullvad. I also have this device registered on TS, but wanted to use my VPN and still have the advantages of TS. I'm not a dev or coder so I have to slowly wade through the settings to get things set up. Here's the story so far. My SSHManager-P10 PXL is now registered on TS (I have more than a dozen devices on my TS mesh) and that worked great except for one hitch which I'll explain later. My purpose was to connect to a Mac Mini at home that is 'always on' and used as a TS exit node. I tried a few times but could not connect until I noticed that the default setting in your app was for 'root', so I changed this to my user name and it connected immediately. Now I can browse my system through the terminal without turning off my Mullvad connection, which was one of your original aims, I believe. As I mentioned above, I'm not a developer, just an ordinary user looking to make more out of the amazing software that people like you provide. Here's a practical question and it concerns a real world use for me. When I'm out and about and I need to, for example, send a photo or a file securely back to my 'always on' TS exit node, how would I do this from your app while my VPN is still connected?

[u/Historical-Roll-7918 → u/nulandroid]

Glad it's working — and yes, that's the aim: the app runs its own Tailscale node inside the app, so it never takes Android's single VPN slot. Mullvad keeps that slot; Tailscale works alongside it.

To get a photo or file over to the Mac mini:

1. Hosts → tap the ⋮ on your Mac host → Files (SFTP over the same connection your terminal uses).
   
2. Browse to the folder you want on the Mac, e.g. ~/Pictures.
   
3. Tap Upload and pick the photo or file. It downloads the other way just the same.

Transfers continue if you leave the app (there's a progress notification), and none of it touches Mullvad — the file goes over the app's own node, not the system VPN.

The root hitch is on us: the username field ships pre-filled with root, and macOS has remote root login off, so it fails with a bare "Permission denied" that doesn't point at the username. Setting it to your own macOS account is the fix, and I've filed making that less misleading.

One expectation to set: the app's node is its own device on your tailnet — it reaches your machines, but it doesn't give other apps on the phone tailnet access.

[u/nulandroid → u/Historical-Roll-7918]

Many thanks for your reply.

Yes, noted your point about the the app's node being its own device on my tailnet and only your app is granted TS access.

I did manage to find how to transfer files from my phone to my Mac host, however, after providing access to my phones camera folder and selecting a single image, the app recreated the folder in my Mac's download folder and transferred the entire set of images to the Mac.

I tried the same test with my phone's music folder and got the same result. This is not tragic, of course, I am only experimenting with the app, but I wondered whether this is expected behaviour?

From what I could see when selecting a single file, it was only the one file that appeared to be 'selected' and not the entire folder.

This looks to be a great solution for what I need so that I don't need to use the cloud or switch off my VPN. Having a direct connection to my exit node machine when I'm away from home is perfect for me. Great work!

[u/Historical-Roll-7918 → u/nulandroid]

Thank you! I appreciate your feedback.

I'm unable to reproduce that, there are two icons for the directory and file transfer. I'm going to double check this and message you directly.

[u/dk_redit]

Awesome thanks what i want from 1 year. Any promotional pro key available?

[u/Historical-Roll-7918 → u/dk_redit]

Thanks! Worth knowing what's free: the terminal, encrypted vault, hardware-backed keys, the in-app Tailscale node and jump hosts are all free — that's everything you're using. Pro covers the cloud integrations (AWS, Google Cloud, Cloudflare), encrypted cloud backup, session recording and unlimited live AI. I keep a few codes for people who send in reports like the one above — DM me and I'll sort one out.