How to create a private SFTP gateway backed by Google Drive with Rclone
How to create a private SFTP gateway backed by Google Drive with Rclone

Category: Tutorials | Level: Intermediate | Platform: Windows 10/11
Tools: Rclone, Google Drive, PowerShell, WinSCP or FileZilla | Protocol: SFTP (SSH File Transfer Protocol)

Contents

Introduction {#uvod}

Google Drive is convenient cloud storage, but a shared folder does not always solve the problem of receiving large uploads. When someone uploads to a folder shared from another user's My Drive, the file may count against the uploader's storage. Google Workspace Shared Drives use an organization-owned storage model, subject to the Workspace plan and its limits.

For a personal workflow, Rclone can expose a dedicated Google Drive folder through an SFTP server running on a Windows computer. A person uploading through SFTP does not need a Google account or direct access to your Drive.

A client might receive connection details like these:

text
Protocol: SFTP
Host: server.example.com
Port: 2222
Username: shared
Password: ********

The Windows computer acts as a gateway. It receives the SFTP connection and uses the owner's Google OAuth authorization to access the configured Drive remote. SFTP clients see only the directory exposed by Rclone. However, the Google OAuth token belongs to the Rclone process and may have access beyond that directory. Limiting the SFTP root does not reduce the token's Google Drive scope.

Architecture and security model {#kako-izgleda-kompletna-arhitektura}

text
                INTERNET
                    │
                    │ SFTP
                    │ TCP 2222
                    ▼
        ┌────────────────────────┐
        │      Windows PC        │
        │                        │
        │   rclone serve sftp    │
        │                        │
        └───────────┬────────────┘
                    │
                    │ Google Drive API
                    │ OAuth 2.0
                    ▼
        ┌────────────────────────┐
        │      Google Drive      │
        │                        │
        │     SFTP-Shared/       │
        │     ├─ Shared/         │
        │     ├─ Incoming/       │
        │     └─ Archive/        │
        └────────────────────────┘

For example, an SFTP client may see only this tree:

text
/
├── Shared
├── Incoming
└── Archive

The rest of the Drive is not visible through this SFTP root. Protect the OAuth token and Rclone configuration because a person who obtains them may be able to access the wider Drive scope granted to Rclone.

Why SFTP instead of FTP? {#zasto-sftp-a-ne-obican-ftp}

Unencrypted FTP can expose credentials and file contents to anyone able to observe the traffic. SFTP runs over SSH and encrypts the connection.

Its practical advantages include:

  • Encrypted credentials and data in transit,
  • A single TCP port instead of FTP's active or passive port ranges,
  • Support in WinSCP, FileZilla, Cyberduck, and standard command-line clients,
  • SSH host keys that let clients verify the server identity,
  • Password or public-key authentication.

Rclone's SFTP server supports authentication options including a username and password, an authorized-keys file, or an authentication proxy. Authentication is required unless the no-auth option is explicitly enabled, which should never be used on a network-accessible server.

Requirements and folder layout {#sta-je-potrebno}

You need:

  • Windows 10 or Windows 11,
  • A Google account with available Drive storage,
  • The official Rclone Windows binary,
  • Access to Google Cloud Console to create an OAuth client,
  • A stable internet connection,
  • Either a private VPN such as Tailscale or a carefully configured network path.

The examples use this folder:

text
C:\sftpserver

Suggested project layout:

text
C:\sftpserver\
├── bin\
│   └── rclone.exe
├── config\
│   ├── rclone.conf
│   └── hostkeys\
│       ├── sftp_ed25519_key
│       └── sftp_ed25519_key.pub
├── logs\
│   └── rclone-sftp.log
├── scripts\
│   ├── setup.ps1
│   ├── start-sftp.ps1
│   ├── stop-sftp.ps1
│   ├── restart-sftp.ps1
│   ├── status.ps1
│   ├── install-autostart.ps1
│   ├── remove-autostart.ps1
│   ├── firewall-enable.ps1
│   └── firewall-disable.ps1
├── secrets\
│   └── sftp-credentials.txt
├── tests\
├── docs\
└── .gitignore

Adjust the path to your own machine. Keep credentials, configuration, private host keys, and logs out of public repositories.

Download Rclone

Download Rclone only from the official Rclone site. Choose the Windows AMD64 build for a standard 64-bit Windows installation, extract it, and place rclone.exe in the bin folder.

text
C:\sftpserver\bin\rclone.exe

Check the installation in PowerShell:

powershell
C:\sftpserver\bin\rclone.exe version

Before running a downloaded binary, consider verifying the archive checksum published by the official project.

Create your own Google OAuth client ID

Rclone's shared Google Drive client ID is being retired during 2026. Rclone's current setup warns about the change, so create and use your own client ID to avoid an interruption. A client ID also gives your application a separate API quota allocation. Google's default quota is 10 transactions per second per client ID; exceeding quota can trigger rate limiting.

Create a Google Cloud project

In the Google Cloud Console:

  1. Create a project, for example, Rclone SFTP Gateway.
  2. Open APIs & Services > Library.
  3. Find Google Drive API and enable it.

For a personal Google account, an external OAuth audience is generally used. Google Workspace administrators may be able to choose an internal audience for users in their organization.

Refresh-token warning: An external OAuth app left in Testing can receive refresh tokens that expire after seven days when it requests Drive scopes. Adding yourself as a test user does not remove that expiry. For an unattended service, follow Google's current publishing and verification requirements, or plan for reauthorization. Do not try to bypass Google's OAuth policy.

Create a desktop OAuth application

In APIs & Services > Credentials:

  1. Choose Create Credentials > OAuth client ID.
  2. Select Desktop app.
  3. Give it a name such as Rclone Desktop Client, then create it.

Google will show a client ID and client secret. Keep them private and never commit them to a public repository.

Create an Rclone Google Drive remote

Run the interactive configuration wizard:

powershell
C:\sftpserver\bin\rclone.exe config

Follow the prompts:

  1. Enter n to create a new remote.
  2. Name it gdrive.
  3. Choose Google Drive as the storage type.
  4. Enter your client ID and client secret.
  5. Choose the narrowest scope that supports your workflow.

For a dedicated folder and files created by Rclone, the drive.file scope can reduce access to other Drive content. Rclone will not see files created outside the app unless they are explicitly authorized. Use the full drive scope only when you need access to existing files that Rclone did not create, and understand that this grants broad access.

  1. Leave the service-account path empty unless you intentionally use a service account.
  2. Decline advanced configuration unless you need it.
  3. Choose browser authentication if the machine can open a browser.

Authorize Rclone in your Google account. The token is saved in rclone.conf. This file contains sensitive authorization data. Restrict it with Windows permissions and consider Rclone's encrypted configuration for unattended use.

Verify the Google Drive connection

List top-level folders on the remote:

powershell
C:\sftpserver\bin\rclone.exe lsd gdrive:

Check the available storage information:

powershell
C:\sftpserver\bin\rclone.exe about gdrive:

Create a dedicated SFTP folder

Do not expose the root of your whole Drive. Create a dedicated folder and subfolders for SFTP users:

powershell
C:\sftpserver\bin\rclone.exe mkdir gdrive:SFTP-Shared
C:\sftpserver\bin\rclone.exe mkdir gdrive:SFTP-Shared/Shared
C:\sftpserver\bin\rclone.exe mkdir gdrive:SFTP-Shared/Incoming
C:\sftpserver\bin\rclone.exe mkdir gdrive:SFTP-Shared/Archive

Verify the result:

powershell
C:\sftpserver\bin\rclone.exe lsd gdrive:SFTP-Shared

Choose local cache or direct upload

Rclone's SFTP server uses a Virtual File System (VFS) layer to adapt cloud objects to file-like operations. The four cache modes are off, minimal, writes, and full.

VFS cache mode: off

This is the default. It reads from and writes to the remote without caching file contents on local disk. Rclone uses memory buffers, so a large transfer does not require the same amount of free disk space as the full file. This is a good fit for straightforward SFTP uploads, but it has compatibility limits:

  • A file being written cannot be freely seeked,
  • Some clients that use random writes may not work as expected,
  • If an upload fails, Rclone cannot retry it from a local cache. The client may have to send it again.
text
Client (SFTP) ──> Windows PC (Rclone Gateway) ──> Google Drive API (5 TB)
   [150 GB]               [Only 30 GB]                [Stored]

Limitations of off mode

  • You cannot freely seek within a file while it is being written.
  • If the network connection drops during an upload, Rclone cannot resume it from a local cache. The client may need to retry the transfer.
  • Some SFTP clients that perform random writes may require buffering.

For a private server that transfers large video files, archives, or ISO images, this is often a reasonable trade-off.

VFS cache mode: minimal

This buffers files opened for simultaneous reading and writing, using some local disk space. It does not provide retry for a failed upload and still has write-operation limitations.

text
--vfs-cache-mode minimal

VFS cache mode: writes

Files opened for writing are first buffered on the server's local disk. Rclone uploads them after the file is closed and can retry failed uploads.

  • Advantage: Better compatibility and retry behavior.
  • Trade-off: The local cache may need space for every active upload.
text
--vfs-cache-mode writes

VFS cache mode: full

This buffers reads and writes on local disk and is closest to normal file-system behavior. It can use substantial cache space. In full mode, cached reads may use sparse files if the local file system supports them.

text
--vfs-cache-mode full

Which mode should you choose?

  • Choose off for simple sequential transfers when the server has limited disk space and the SFTP client supports the restrictions.
  • Choose writes when clients need more normal write behavior or automatic retry and the server has enough disk space.
  • Use full only when the application's access pattern needs it and you can manage the cache.

Test with the actual SFTP clients and file types you plan to support.

RAM and Google Drive chunking

Rclone streams data through buffers in off mode. The Google Drive backend currently documents an 8 MiB default upload chunk. Each active transfer can require memory for its current chunk, so increasing chunk size may increase RAM use. Keep the default unless measurements show a reason to change it.

Create an SFTP host key

Use a persistent ED25519 host key so clients see the same server identity after each restart. Generate it once and protect the private key. The example creates an unencrypted host key so a scheduled process can start without an interactive passphrase. Limit file access to the service account and administrators.

powershell
C:\Windows\System32\OpenSSH\ssh-keygen.exe `
  -t ed25519 `
  -f "C:\sftpserver\config\hostkeys\sftp_ed25519_key" `
  -N '""'

The key pair contains a private server key and a public key. Never share the private key.

Check the host-key fingerprint

Calculate the fingerprint from the public key and give it to clients through a trusted channel:

powershell
ssh-keygen -lf "C:\sftpserver\config\hostkeys\sftp_ed25519_key.pub"

Clients should verify the fingerprint the first time they connect. If it changes unexpectedly, stop and investigate before accepting the new key.

SFTP password authentication

For a basic shared account, use a long, unique random password. Do not put the password directly in a command-line argument: process inspection tools may expose command arguments. An environment variable avoids putting it in the command line, but is not a secure secret store. A same-account process or administrator may still be able to access it.

For a server used by more than one person, SSH public keys provide better individual control than a shared password. Give each person a separate account or use an authentication proxy when you need distinct directory roots.

Use SSH keys where possible

Rclone accepts an authorized-keys file. Give each client a separate public-key entry so access for one person can be revoked without changing everyone else's credentials. Protect the file from edits by untrusted users.

Start the SFTP server

The following example reads a password from a local file into RCLONE_PASS and then starts the server. Protect the credentials file with restrictive NTFS permissions. Prefer public-key authentication for a long-running internet-accessible service.

powershell
$env:RCLONE_PASS = (Get-Content "C:\sftpserver\secrets\sftp-credentials.txt" -Raw).Trim()
& "C:\sftpserver\bin\rclone.exe" serve sftp "gdrive:SFTP-Shared" `
    --config "C:\sftpserver\config\rclone.conf" `
    --addr "0.0.0.0:2222" `
    --user "shared" `
    --key "C:\sftpserver\config\hostkeys\sftp_ed25519_key" `
    --vfs-cache-mode off `
    --dir-cache-time 5m `
    --poll-interval 1m `
    --log-file "C:\sftpserver\logs\rclone-sftp.log" `
    --log-level INFO

The Rclone SFTP server defaults to localhost on port 2022. The example explicitly listens on port 2222 on all network interfaces. That makes the service reachable from other interfaces if the firewall and network allow it. For local testing, bind only to localhost. For Tailscale, prefer the device's private Tailscale address and limit firewall access to approved clients.

Why use port 2222?

Port 22 is the default SSH port and may already be used by Windows OpenSSH Server. Port 2222 avoids that local conflict and can reduce noise from scanners, but changing the port is not a security control. Strong authentication, firewall restrictions, updates, and monitoring still matter.

Configure Windows Firewall

Create a TCP 2222 inbound rule in an elevated PowerShell session. Restrict the remote addresses to your LAN or specific VPN clients instead of opening it to every source:

powershell
New-NetFirewallRule `
  -DisplayName "Rclone SFTP Google Drive" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 2222 `
  -RemoteAddress "192.168.1.0/24" `
  -Profile Private `
  -Action Allow

Check the rule:

powershell
Get-NetFirewallRule -DisplayName "Rclone SFTP Google Drive"

Test on your local network

Test locally before allowing remote access:

  1. Connect from the server to 127.0.0.1:2222 with WinSCP.
  2. Connect from a second computer on the same trusted LAN.
  3. Verify that the client can see only the intended folder tree.
text
/
├── Shared
├── Incoming
└── Archive

Required transfer tests

Check login, directory listing, folder creation, upload, and download. Compare a file hash before and after transfer:

powershell
Get-FileHash .\test-100mb.bin -Algorithm SHA256

The hashes should match exactly. Repeat tests using the cache mode and SFTP clients you intend to support.

Confirm uploads reach Google Drive

After an upload, list the remote folder directly with Rclone:

powershell
C:\sftpserver\bin\rclone.exe lsf gdrive:SFTP-Shared/Incoming

A successful SFTP transfer should be checked in the backend as well, especially when using a write-back cache.

Check local disk usage

During a large upload, observe the server's disk use. With VFS mode off, Rclone does not cache the file contents on disk. With writes or full, local cache usage can grow substantially. Do not promise zero local disk usage if logs, configuration, or other Rclone caches are stored locally.

Large files

A file larger than the server's free disk space can be transferred in off mode when the client uses a compatible sequential write pattern and the network remains stable. For example, a server with 35 GB free may receive a 120 GB file to Drive without storing the whole file locally. This is not a guarantee of resumability: a broken upload in off mode may need to restart.

Google Drive limits

Google documents a user upload and copy limit of 750 GB in a 24-hour period and a maximum individual file size of 5 TB. When the daily threshold is reached, additional uploads may be blocked until the limit refreshes. A file in progress may finish. These limits can vary by account and product, so check Google's current Drive upload and storage limits.

Rclone provides an option to stop when the Drive upload limit is reached. Check the current Rclone documentation before adding it to a service command.

Transfer speed

Data travels from the SFTP client to your Windows PC and then from that computer to Google's servers. The slower of the client's upload, the gateway's download and upload, and available Drive API throughput can limit speed. A 200 Mbps home upload connection has a theoretical ceiling of about 25 MB/s before protocol overhead and other bottlenecks.

What happens if the internet connection drops?

With VFS mode off, a failed upload cannot be retried from a local cache. The client may need to send the file again. Choose writes if retry behavior is more important than local disk usage, and make sure the cache has enough free space.

What happens if the computer shuts down?

Files that have completed upload remain in Google Drive. The SFTP service is unavailable until the computer is back online. If you use writes mode, files still waiting in the cache may not yet be in Drive; allow Rclone to finish its write-back and use the same cache location after restart.

Run at startup with Task Scheduler

To start Rclone when Windows starts:

  1. Open Task Scheduler.
  2. Create a task named Rclone-SFTP-GDrive.
  3. Set its trigger to system startup and allow time for networking to come up.
  4. Configure the action to run the PowerShell start script.
  5. Use a dedicated Windows account with only the permissions it needs.

PowerShell start script

Create a start-sftp.ps1 script. It reads the password from the protected file and passes the local configuration and host key to Rclone:

powershell
$Root = "C:\sftpserver"
$Rclone = "$Root\bin\rclone.exe"
$Config = "$Root\config\rclone.conf"
$HostKey = "$Root\config\hostkeys\sftp_ed25519_key"
$Log = "$Root\logs\rclone-sftp.log"

# Load the password from a protected file or environment variable
$PasswordFile = "$Root\secrets\sftp-credentials.txt"
if (Test-Path $PasswordFile) {
    $env:RCLONE_PASS = (Get-Content $PasswordFile -Raw).Trim()
}

& $Rclone serve sftp "gdrive:SFTP-Shared" `
    --config $Config `
    --addr "0.0.0.0:2222" `
    --user "shared" `
    --key $HostKey `
    --vfs-cache-mode off `
    --dir-cache-time 5m `
    --poll-interval 1m `
    --log-file $Log `
    --log-level INFO

Store secrets outside the script and limit access to the credentials file. Environment variables are visible to sufficiently privileged local processes and should not be treated as a vault.

Logging

Use an appropriate log level, protect logs from other users, and plan log rotation so the log file cannot fill the disk. Check the Rclone SFTP log when diagnosing failed transfers.

Router port forwarding

The safer default for private sharing is a VPN such as Tailscale, with no public port forward. If you choose to expose SFTP directly, understand that the service is reachable from the public internet. Forward only the selected TCP port to a fixed LAN address, restrict firewall source addresses where possible, use unique credentials or SSH keys, and monitor access.

Public IP and dynamic DNS

If you deliberately host a public endpoint and your public IP changes, a dynamic DNS provider can map a hostname to the current address. For example:

text
Host: my-server.duckdns.org
Port: 2222

A hostname does not add encryption or access control. SFTP provides encryption, but you still need strong authentication and firewall rules.

CGNAT

If your ISP uses carrier-grade NAT, often using addresses in 100.64.0.0/10, ordinary router port forwarding may not make the server reachable from the public internet. Ask your ISP about a public address or use a private VPN overlay.

Tailscale as an alternative

If you are behind CGNAT or do not want to open a public port, install Tailscale on the server and approved clients. Keep SFTP reachable only on the private tailnet address, and grant access only to the people who need it. Confirm the Windows Firewall rule matches the intended Tailscale clients.

Configure WinSCP for clients

Give clients only the parameters they need. Verify the host-key fingerprint through a trusted channel:

text
Protocol: SFTP
Host: moj-server.duckdns.org (or public IP)
Port: 2222
Username: shared
Password: (configured password)
Host key fingerprint: SHA256:xxxxxxxxxxxx

Do not send a password and fingerprint in the same untrusted message. Prefer individual SSH keys over a shared password.

FileZilla

In FileZilla Site Manager, select SFTP, enter the host and port, and configure the username and chosen authentication method. Verify the server's host-key fingerprint when prompted.

Clients do not need a Google account

SFTP users do not need to sign in to Google Drive or install Drive software. They use their SFTP credentials or key. The owner remains responsible for Drive storage, OAuth scope, and account security.

Multiple SFTP users

For multiple people, use separate accounts and directories. Rclone's authentication proxy can map credentials to backend configurations, but it requires careful implementation. Do not share one writable root with untrusted users.

Read-only users

For a read-only instance, use Rclone's read-only option:

text
--read-only

Test from a client account to confirm that reads work and writes are rejected.

Bandwidth limit

To limit transfer bandwidth, Rclone supports a bandwidth-limit option. For example, 15M is approximately 15 MB/s depending on the unit conventions:

text
--bwlimit 15M

Check current Rclone documentation for accepted units and scheduling syntax.

Directory cache

Rclone keeps directory metadata in memory to avoid an API request for every listing. These options tune cache lifetime and polling where the backend supports it:

text
--dir-cache-time 5m
--poll-interval 1m

External changes may take time to appear, depending on backend polling support and cache settings.

Should you increase parallel transfers?

With cache mode off, start with a small number of parallel transfers. Increase it only after measuring stability, memory use, network capacity, and API behavior.

Google Drive API throttling

If Google returns a rate-limit error, Rclone uses retry and backoff behavior. A personal OAuth client avoids relying on Rclone's retiring shared client ID, but it does not remove Google's quota limits.

Protect sensitive files

Never commit rclone.conf, the private SFTP host key, credentials, or logs to a public repository. A sample .gitignore can exclude them:

gitignore
config/rclone.conf
config/hostkeys/*
!config/hostkeys/*.pub
secrets/
logs/
*.log

The configuration contains OAuth tokens. Store backups of it encrypted and restrict file permissions.

Restrict NTFS permissions

Limit access to secrets and configuration folders to the Windows service account and administrators. Apply restrictive ACLs to the private host key and credentials file, then verify the effective permissions.

Do not expose management interfaces

Do not expose Rclone's Web GUI or remote-control ports to the internet. Expose only the SFTP service if you deliberately need remote access. Never disable authentication on a network-accessible server.

Recommended configuration overview

text
Protocol:         SFTP
Backend:          Google Drive (dedicated folder)
Port:             2222 (TCP)
Authentication:  RCLONE_PASS (Env) / SSH Keys
Host Key:         ED25519
VFS mode:        off (direct stream to cloud)
Directory Cache:  5 minutes
Google Polling:   1 minute
Firewall:         TCP 2222 Inbound

For most personal use, prefer Tailscale or another private network, individual credentials, a dedicated Drive folder, and only the minimum OAuth scope required.

When should you use writes instead of off?

Choose writes when your SFTP clients need seek or random-write behavior, or when retry after a failed upload is important. Make sure the server has adequate cache space and monitor it.

Compare VFS modes

ModeLocal disk useCompatibilityRetry from cacheLarge uploads on a small disk
offLow for file contentsBasicNoSuitable for compatible sequential transfers
minimalSomeModerateNoDepends on client behavior
writesCan approach active upload sizeHighYesRequires enough cache space
fullPotentially highHighestYesRequires cache planning

Cache size and behavior depend on active files and cache settings. Do not treat the mode name as a disk-space guarantee.

What this setup provides

The Windows computer acts as an SFTP gateway while Google Drive stores the files. SFTP clients do not need Drive accounts, but the server owner remains responsible for the gateway, credentials, quota, and backups.

Possible uses

  • Sharing large video and audio files,
  • Sending off-site backups from remote computers,
  • Sharing family archives,
  • Accessing files from mobile devices or Linux command-line clients.

What this is not

Google Drive is a cloud file-storage service, not a normal local file system or database. Its semantics differ from NTFS, ext4, and ZFS. Do not use it as an actively written transactional database. Rclone provides an interface, but cannot make every local file-system operation behave identically on a cloud backend.

Monitoring

Check whether the service is listening on port 2222:

powershell
Get-NetTCPConnection -LocalPort 2222 -State Listen

Also monitor Rclone logs, transfer failures, available disk space, and Drive quota.

Back up the configuration

Keep encrypted backups of rclone.conf and the private SSH host key in a secure location. You need both to restore the service without changing the server identity or reauthorizing Google Drive.

Change the SFTP password

If using password authentication, update the protected credentials file and restart the service. Notify clients through a secure channel. With SSH keys, remove or replace the relevant public-key entry instead.

Suggested rollout

  1. Phase 1: One test user, a dedicated Drive folder, cache mode off, local-only access.
  2. Phase 2: Add Task Scheduler, logs, and a private VPN.
  3. Phase 3: Give each user an individual SSH public key and directory.
  4. Phase 4: Add an authentication proxy only if you need dynamic user-to-folder mapping.

Security checklist

  • Use SFTP, not unencrypted FTP.
  • Keep a persistent ED25519 host key and protect its private half.
  • Use SSH keys or a unique strong password.
  • Restrict the SFTP root to a dedicated folder.
  • Choose the narrowest OAuth scope that works.
  • Use VFS mode off only when clients can work with its limitations.
  • Expose the port only to trusted clients, preferably through a private VPN.
  • Keep rclone.conf, credentials, and private keys out of Git.
  • Test transfers and compare SHA-256 hashes.
  • Monitor logs, disk use, and Google Drive quota.

Final result

This setup can provide a practical SFTP gateway backed by a dedicated Google Drive folder. It works best for straightforward file transfer when the limitations of cloud storage and the selected VFS mode are understood. Keep the service private where possible, protect the OAuth token, and test recovery before relying on it for important data.

Official references {#zvanicni-izvori-i-dokumentacija}