I’m going to be away from home for a few weeks and would like to access my computer (LMDE) while I’m away. Remote desktop connection would be ideal, just file transfer would be acceptable.

Is a VPN necessary, or can port forwarding be good enough for a one time use?

What software/networking recommendations do you have?

  • neatchee@piefed.socialEnglish
    23·
    2 days ago

    You have several options.

    First important question, though: what type of router do you have? If you own your own router, instead of using the one provided by your ISP, then you may have additional options.

    1. Tailscale VPN - Quick and easy setup. “Just works”. Creates an environment like your computers are connected to the same network. Requires setup on each device. Some limits on free plan.
    2. *Wireguard VPN (router host) - Configuration required at the router. Only remote devices need additional setup; devices at home don’t need individual config. *Must be supported by router
    3. SSH tunnel - Ideal for terminal only, though X11 forwarding is possible. Requires either a router that has an SSH server, or port forwarding. Not recommended to allow username/password-only auth; should configure for key-based auth (rsa256/ed25519) only
    4. Secure Remote Desktop (hosted service) - TeamViewer and similar services provide remote desktop access through account-based login, using their relays. Theoretically secure but susceptible to account takeover attacks.
    5. Secure Remote Desktop (direct connect or self-hosted service) - Relay-less (e.g. NoMachine) and self-hosted relay (e.g. RustDesk) provide secure, self managed remote desktop. Requires router port forwarding or reverse-proxy configuration at the router.

    There are other options (like OpenVPN or Wireguard hosted on a device internal to the network, rather than the router) but I personally recommend one of the above 5 options depending on your use case and risk profile.

    If you travel a lot, consider purchasing a travel router (eg GL-iNet devices). Once configured, they act as a repeater or access point for your devices, including forwarding all traffic over a VPN. You arrive at your destination, plug in the travel router, use its webUI to connect it to the hotel or guest Wi-Fi of your choice, and then connect all your personal devices to its Wi-Fi network. No need for connecting every device to a new network at each destination. They support captive portal login, AdGuard Home baked in, blocking all non-VPN traffic, and more.

    • FoxAlive@lemmy.zipEnglish
      1·
      2 days ago

      I have a mango but its kind of showing its age, what’s a decent modern one these days?

    • 18107@aussie.zoneOPEnglish
      3·
      2 days ago

      My router is running OpenWRT (and stopped having intermittent issues after replacing the stock OS).

      I’m leaning toward Tailscale for the “quick and easy” recommendation. If I need to do this again, I might try something a little more advanced.

      • neatchee@piefed.socialEnglish
        141·
        2 days ago

        If you’re already running OpenWRT then I personally recommend Wireguard over tailscale if you have the time. It’s not hard to set up at all and takes the third party out of the loop. OpenWRT has excellent support for Wireguard configuration and export of configs to the devices you want to connect (install client, import config). The only “gotcha” is needing DynamicDNS (assuming you don’t have a static public IP)

        Tailscale is definitely super-simple but this IS the self-hosted community ;D I always prefer removing third parties at every opportunity.

        • 18107@aussie.zoneOPEnglish
          8·
          2 days ago

          This is why I ask humans instead of AI. I didn’t consider router level options.

          I’ve already got dynamic DNS set up, and I’ve been meaning to set up a way to access my NAS from out of the house. This might be the final push I need.

          • Err(()).unwrap()@lemmy.worldEnglish
            8·
            2 days ago

            One obstacle you might encounter is carrier-grade NAT or CGNAT. Some ISPs put residential subscribers behind an additional layer of IPv4 NAT, which makes your public address inaccessible from the internet. In that case, you’ll either need Tailscale or a similar service, or a VPS to act as a relay.

            Then there’s Vodafone who have unilaterally removed both the port-forward feature and bridge mode from their residential cable modems, and I hate them, and wish them a hammer to balls.

            • Wildmimic@anarchist.nexusEnglish
              1·
              2 days ago

              They removed BOTH? what in the… portforwarding is a pretty basic feature to have, and i would switch ISP if they took away Bridge Mode from me.

              • Err(()).unwrap()@lemmy.worldEnglish
                2·
                2 days ago

                They removed almost every basic networking feature with a firmware update. Even in “expert mode”, all I can do is set up the wifi and pick a single /24 network from 192.168.0.0/16. I can’t even pick a goddamn DNS server. Unfortunately the other ISPs that serve my area are at least twice as expensive.

                • Wildmimic@anarchist.nexusEnglish
                  2·
                  2 days ago

                  Wow. An ISP going down the route of enshittification by taking away networking basics is not something that i would have expected years ago, but nowadays i am only sad about it.

                  My ISP wants me to swap out my modem, but as long as it works i won’t do so - i fear they might take away my (officially dynamic, but only changing once in a blue moon when they make changes in their network topology) IPv4 address and stick me back behind the awful CGNAT they have as they did once without asking years ago.

      • lemmyvore@feddit.nlEnglish
        4·
        2 days ago

        Please note that the Tailscale binaries for OpenWRT are pretty large (even if you cross-compile them with compact and strip). Your router might not have enough storage for it.

        If that’s the case, you might work around it by only storing the tailscaled binary on persistent storage, because that’s the daemon which runs the actual connectivity. The tailscale binary is only used for making configuration changes, you can copy that to RAM disk, use it to set config params, then delete it.

    • youmaynotknow@lemmy.zipEnglish
      2·
      2 days ago

      This is very sound advice. Pretty similar to my infrastructure. The gl-inet travel router already with wireguard to VPN into my home network is one of the best decisions I’ve ever made.

      • neatchee@piefed.socialEnglish
        2·
        2 days ago

        Right? Especially when I had symmetric gigabit (rip marital home before divorce) it was such a game changer. Still great with 1000/50 docsis just not quite as great lol

        It also took me a bit to realize GL-iNet is just a custom openwrt stack and you can reach the luci console for advanced tinkering :3

  • BartyDeCanter@piefed.socialEnglish
    101·
    2 days ago

    Just set up a basic ssh connection, using key based authentication. You don’t need anything past that for a basic short term connection. I used one for years with port forwarding through my router to the ssh port on my desktop.

    Now that I have a more complex setup with several services I use Tailscale and run my own Headscale server for it. But still, basic ssh will get you a long way and should be the first thing you do.

  • Lettuce eat lettuce@lemmy.mlEnglish
    19·
    2 days ago

    Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you’re gold.

    I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent’s home PC across the country to check updates and backups.

    Fast, easy, free, and secure.

  • ExLisper@lemmy.curiana.netEnglish
    7·
    2 days ago

    Everyone says tailscale but if you don’t want to setup an account with google or Microsoft login, Netbird is the way to go.

    • Vakbrain@lemmy.dbzer0.comEnglish
      3·
      2 days ago

      This!

      Make sure to enable connect with IP in Rustdesk, and use the ip supplied by Tailscale when your not home.

      Easy!

      (If you use linux, make sure to use X11 rather than Wayland on your session to allow unattended connections)

  • KaninchenSpeed@lemmy.blahaj.zoneEnglish
    6·
    2 days ago

    just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.

    • prole@lemmy.blahaj.zoneEnglish
      2·
      2 days ago

      This is probably a dumb question, but as someone who has never fucked with SSH, is there anything that I need to do to my basic Linux install to make sure randos cannot do what you just described (without permission)?

      • f314@lemmy.worldEnglish
        3·
        2 days ago

        When they say “password auth disabled” they don’t mean being ble to log in without authentication. It means that your machine instead authenticates with an SSH key:

        You generate a private/public key pair on your computer (the one you will take with you), and add the public key from that pair to a list of trusted computers on your server. When logging in, your computer will prove to the server who it is by generating that same public key. No password needed.

        1. Generate a key pair with ssh-keygen -t ed25519 on you computer.
        2. Copy the contents of ~/.ssh/id_ed25519.pub from you computer into a file on you server called ~/.ssh/authorized_keys.

        That’s it!

        The file on the server should be in the home directory of the user you want to log in as. If it already exists, add the key you generated to the end of it.

  • Guiorgy@lemmy.mlEnglish
    4·
    2 days ago

    Never expose the bare remote control endpoint publicly. For example, recently macOS had a critical vulnerability where an attacker could completely bypass authentication on their Screen Sharing daemon, and the researcher had estimates around 40k publicly exposed systems, and it was found out that the vulnerability was in fact being used in the wild. Exposing things like that publicly is asking for trouble.

    Personally I don’t like relying on 3rd party systems like Tailscale, so I just have a WireGuard peer running firewalled to only allow access to what is necessary, though you can skip the firewall part. This obviously assumes you have a routable public IP, i.e. no CGNAT, if that’s not the case Tailscale is probably what you want.

  • AbouBenAdhem@lemmy.worldEnglish
    112·
    2 days ago

    If you set up one port forward to any SSH server on your local network (e.g., a spare Raspberry Pi), you can then use SSH tunneling to mirror any port on any machine in your local network to ports on your remote SSH client. And it leaves no trace on either side outside of the terminal session.

  • qwerty@discuss.tchncs.deEnglish
    6·
    2 days ago

    If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.

    ssh -R 8022:localhost:22 user@relay

    As long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with

    ssh -p 8022 user@relay

    so make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you’re gonna use unsecure protocols like VNC. First ssh to the server

    ssh user@relay

    next

    ssh user@localhost -p 8022

    or one line, especially useful when combined with -i to point at the home pc’s ssh key stored on the client

    ssh -J user@relay user@localhost -p 8022

    You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports

    ssh -R 5901:localhost:5901 user@relay

    or together

    ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relay

    On the client ssh with the -L flag

    ssh -L 5091:localhost:5091 user@relay

    Now you can connect your VNC client to

    localhost:1

  • TheFogan@programming.devEnglish
    7·
    3 days ago

    I guess depends on the risk factor you want to take. For me I’d go VPN. You could go port forwarding, or you could even do something like temporarally use something like anydesk depending if you want to trust a corporation for remote access.