p10q / Cell / Cell Remote setup

Cell Remote setup

A one-time AWS setup that lets Cell Remote on your iPhone or iPad reach your Mac from anywhere without opening inbound ports on your network or on AWS.

How it works

Your Mac sits behind your home or office NAT and can't accept inbound connections directly. Cell solves this with a small EC2 instance in your own AWS account that acts as a meeting point. Both your Mac and your iPhone reach it outbound through AWS EC2 Instance Connect Endpoint (EICE), an IAM-authenticated tunnel that AWS recommends for bastion-style access.

Mac ──outbound──► AWS EICE ──► EC2 jump host ◄──outbound── iPhone IAM auth no public IP, IAM auth no inbound ports └────── reverse tunnel held by the Mac so the iPhone reaches it ──────┘
Mac │ outbound + IAM ▼ AWS EICE │ ▼ EC2 jump host ▲ │ outbound + IAM iPhone Mac holds the reverse tunnel that lets the iPhone reach it.
Cost. Cell provisions a t4g.nano jump host and a small EBS volume. Expect a total cost of roughly $5 per month, depending on your AWS region and usage. EICE does not charge for the endpoint or tunnel hours.

1Create or sign in to an AWS account

If you don't already have one, create an AWS account. AWS requires a payment method, and the Cell resources incur the estimated monthly cost above.

You can use a dedicated AWS account for Cell; nothing else needs to be in it.

2Install the AWS CLI and sign in

Cell uses your local AWS CLI to provision the jump host.

The examples keep the existing cairn AWS profile name so previously configured credentials continue to work.

Your Mac ──► aws CLI ──► your AWS account
  1. brew install awscli
  2. Create an IAM user in the AWS console with programmatic access, and copy its access key + secret.
  3. aws configure --profile cairn
Optional: verify it worked 
AWS_PROFILE=cairn aws sts get-caller-identity

The command should print your account ID and the IAM user ARN.

3Provision the jump host

In Cell, open Remote > Jump Host and select Set Up Jumpbox. Cell creates a security group with no inbound rules, an EC2 Instance Connect Endpoint, an EC2 instance in your default VPC, and a hardened sshd configuration.

4Pair Cell Remote

  1. Install Cell Remote from the App Store.
  2. On your Mac, open Remote > Pair iPhone. A QR code appears.
  3. Scan the QR code with Cell Remote.

Cell creates a per-iPhone IAM user scoped to ec2-instance-connect:OpenTunnel for this endpoint, generates a fresh SSH key for the device, and stores the credentials in the device-only iOS Keychain.

5Connect from iPhone or iPad

Once paired, Cell Remote connects through AWS to your Mac wherever it is. Cell renews the reverse tunnel about every 50 minutes to stay within EICE's one-hour limit.

Tearing it down

Open Remote > Jump Host and select Deprovision. Cell removes the jump-host infrastructure. Use Remote > Paired iPhones to revoke SSH access, and remove matching cairn-iphone-* IAM users from AWS when you no longer need them.

Questions and issues

Visit Cell Support or email tom@p10q.com. Do not send pairing codes, SSH private keys, or AWS secret access keys.