Port forwarding is moderately simple but there are risks to just opening a port and not guarding it with appropriate firewall rules. This includes an SSH server if not up-to-date.

Whereas setting up something like Tailscale on your machine and on your laptop is exceedingly straightforward, avoids firewall reconfigurations, and Just Works™. You could then connect to whatever service you have running, just as if you were on your LAN. My only gripe is that you do need a Google/Microsoft/GitHub/Apple account or OIDC to set up.

In the long term, if you have misgivings about that company operating the coordination server necessary for this tunneling solution, then there’s always the open-source Headscale, which is a drop-in replacement.

will recommend. just use Tailscale. you may distrust any of these OIDC providers, but that doesn’t mean they can see your traffic. long term if you’re paranoid move to Wireguard or Headscale, but this is so simple it’s a no-brainer

If you’re gonna use an overlay network like Tailscale I would highly recommend also taking a look at netbird. Similar concept, but fully self hostable if the need arises (but not recommended unless you have a specific need).

Wireguard

I guess depends on the risk factor you want to take. For me I’d go VPN. You could go port forwarding, or you could even do something like temporarally use something like anydesk depending if you want to trust a corporation for remote access.

If you set up one port forward to any SSH server on your local network (e.g., a spare Raspberry Pi), you can then use SSH tunneling to mirror any port on any machine in your local network to ports on your remote SSH client. And it leaves no trace on either side outside of the terminal session.

That sounds…not…smart…

I think it’s fine. Want to explain why you think that it’s an issue?

I clearly misread that. Basically an SSH jump box, yeah?

Why? It sounds fine to me. OpenSSH is the standard for secure remote access. And port forwarding works great.

Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you’re gold.

I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent’s home PC across the country to check updates and backups.

Fast, easy, free, and secure.

Tailscale is easier and has a generous free tier, Netbird is free and has more features

Answering on the idea of port forwarding. Though like others have said, tailscale or similar is a better option.

Opening an ssh port would allow file transfer. You could also so remote desktop with port forwarding over ssh and vnc (or some other more modern protocol, haven’t futzed with anything like that in a long time).

Probably doesn’t need saying but make sure your system is up to date. Also using a nonstandard port and using key based authentication and disallowing password authentication and good security measures. If the device you’re connecting from isn’t something you’re bringing with you, you’d also need a copy of your private key.

OpenSSH is one of the most secure applications in the world. It’s fine to expose it to the Internet. Just be sure you have excellent passwords or don’t allow password auth.

Don’t bother with excellent passwords, just never allow password auth on anything remote.

If you want a full complete remote desktop solution, you should probably look at VNC and portforwarding its port. I think it’s 3001.

Or if you won’t (or can’t) mess with port forwards, you could setup something like RustDesk for the TeamViewer experience.

3001

5900

Thanks. Been so long since I’ve used vnc that I couldn’t remember.

If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.

ssh -R 8022:localhost:22 user@relay

As long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with

ssh -p 8022 user@relay

so make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you’re gonna use unsecure protocols like VNC. First ssh to the server

ssh user@relay

next

ssh user@localhost -p 8022

or one line, especially useful when combined with -i to point at the home pc’s ssh key stored on the client

ssh -J user@relay user@localhost -p 8022

You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports

ssh -R 5901:localhost:5901 user@relay

or together

ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relay

On the client ssh with the -L flag

ssh -L 5091:localhost:5091 user@relay

Now you can connect your VNC client to

localhost:1

Jesus… Just port forward 22 to your system and ssh in directly.

That’s not always an option and when it is, setting it up is often more complicated and less secure than using a relay server. Honestly, the fastest (to setup), easiest and most secure option would be ssh server as a tor hidden service. Everything is handled by tor out of the box, .onion domain name, nat hole punching, E2EE, port scanning bots… all taken care of, no need for opening ports, static ip, dns, ddns, fail2ban, worrying that there’s a 0 day or that you misconfigured something. No one can exploit you service if nobody knows it exists.

Setting up ssh is nearly trivial. And saying it’s “less secure” doesn’t mean it’s insecure.

It’s the primary access point for thousands of systems and for good reason. It’s “good enough” for your little homelab.

Depends what you mean by setting up ssh. Installing sshd, sure. Opening up ports, calling your isp to buy dedicated ip if they even offer one, getting a domain, setting up ddns…

Opening ports is also trivial. You don’t generally need a dedicated IP if you keep a connection running but YMMV. And you don’t need a domain - just remember the IP. This is only for a few weeks.

If you’re behind cgnat oppening ports on your router won’t do you any good. You have to call your isp and ask them for a dedicated public ip, usually for a price if they offer one at all. If that ip is static you can remember it, if not, you need ddns. If you’re one of the lucky few not behind cgnat then yeah, your setup will be the simplest possible, but if you are, like the majority of people these days, it’s one of the most complicated.

Well yeah, duh.

Wireguard server in your home network, remote access via DDNS is the way I do it.

You have several options.

First important question, though: what type of router do you have? If you own your own router, instead of using the one provided by your ISP, then you may have additional options.

1. Tailscale VPN - Quick and easy setup. “Just works”. Creates an environment like your computers are connected to the same network. Requires setup on each device. Some limits on free plan.
2. *Wireguard VPN (router host) - Configuration required at the router. Only remote devices need additional setup; devices at home don’t need individual config. *Must be supported by router
3. SSH tunnel - Ideal for terminal only, though X11 forwarding is possible. Requires either a router that has an SSH server, or port forwarding. Not recommended to allow username/password-only auth; should configure for key-based auth (rsa256/ed25519) only
4. Secure Remote Desktop (hosted service) - TeamViewer and similar services provide remote desktop access through account-based login, using their relays. Theoretically secure but susceptible to account takeover attacks.
5. Secure Remote Desktop (direct connect or self-hosted service) - Relay-less (e.g. NoMachine) and self-hosted relay (e.g. RustDesk) provide secure, self managed remote desktop. Requires router port forwarding or reverse-proxy configuration at the router.

There are other options (like OpenVPN or Wireguard hosted on a device internal to the network, rather than the router) but I personally recommend one of the above 5 options depending on your use case and risk profile.

If you travel a lot, consider purchasing a travel router (eg GL-iNet devices). Once configured, they act as a repeater or access point for your devices, including forwarding all traffic over a VPN. You arrive at your destination, plug in the travel router, use its webUI to connect it to the hotel or guest Wi-Fi of your choice, and then connect all your personal devices to its Wi-Fi network. No need for connecting every device to a new network at each destination. They support captive portal login, AdGuard Home baked in, blocking all non-VPN traffic, and more.

My router is running OpenWRT (and stopped having intermittent issues after replacing the stock OS).

I’m leaning toward Tailscale for the “quick and easy” recommendation. If I need to do this again, I might try something a little more advanced.

If you’re already running OpenWRT then I personally recommend Wireguard over tailscale if you have the time. It’s not hard to set up at all and takes the third party out of the loop. OpenWRT has excellent support for Wireguard configuration and export of configs to the devices you want to connect (install client, import config). The only “gotcha” is needing DynamicDNS (assuming you don’t have a static public IP)

Tailscale is definitely super-simple but this IS the self-hosted community ;D I always prefer removing third parties at every opportunity.

This is why I ask humans instead of AI. I didn’t consider router level options.

I’ve already got dynamic DNS set up, and I’ve been meaning to set up a way to access my NAS from out of the house. This might be the final push I need.

One obstacle you might encounter is carrier-grade NAT or CGNAT. Some ISPs put residential subscribers behind an additional layer of IPv4 NAT, which makes your public address inaccessible from the internet. In that case, you’ll either need Tailscale or a similar service, or a VPS to act as a relay.

Then there’s Vodafone who have unilaterally removed both the port-forward feature and bridge mode from their residential cable modems, and I hate them, and wish them a hammer to balls.

Brave of you to assume I’m human.

…I mean, I am human, but it’s brave to assume

😂

Please note that the Tailscale binaries for OpenWRT are pretty large (even if you cross-compile them with compact and strip). Your router might not have enough storage for it.

If that’s the case, you might work around it by only storing the tailscaled binary on persistent storage, because that’s the daemon which runs the actual connectivity. The tailscale binary is only used for making configuration changes, you can copy that to RAM disk, use it to set config params, then delete it.

This is very sound advice. Pretty similar to my infrastructure. The gl-inet travel router already with wireguard to VPN into my home network is one of the best decisions I’ve ever made.

Right? Especially when I had symmetric gigabit (rip marital home before divorce) it was such a game changer. Still great with 1000/50 docsis just not quite as great lol

It also took me a bit to realize it’s just a custom openwrt stack and you each the luci console for advanced tinkering :3

Access to the Luci ui is the reason I bought the first one I got 😁

Take a look at Yggdrasil.

yggdrasil-network.github.io

tailscale. and then use vnc(tigervnc-server or x11vnc) and ssh

Tailscale + Rustdesk has worked for me so far.

Simple, easy, free and just works.

This!

Make sure to enable connect with IP in Rustdesk, and use the ip supplied by Tailscale when your not home.

Easy!

(If you use linux, make sure to use X11 rather than Wayland on your session to allow unattended connections)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters AP WiFi Access Point CGNAT Carrier-Grade NAT DNS Domain Name Service/System ISP Internet Service Provider NAS Network-Attached Storage NAT Network Address Translation SSH Secure Shell for remote terminal access VNC Virtual Network Computing for remote desktop access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)

10 acronyms in this thread; the most compressed thread commented on today has 14 acronyms.

[Thread #129 for this comm, first seen 15th Oct 2026, 09:50] [FAQ] [Full list] [Contact] [Source code]

Just use ssh and be sure to disable remote root access and require key based authentication. If it’s good enough for aws, azure, etc. then it’s good enough for what you want.

You’ll want to read up on port forwarding and pick a remote gui tool. “No machine” works very well for x11, but rdp is supported by some wayland displays. Vnc is the old workhorse.

just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.

This is probably a dumb question, but as someone who has never fucked with SSH, is there anything that I need to do to my basic Linux install to make sure randos cannot do what you just described (without permission)?

When they say “password auth disabled” they don’t mean being ble to log in without authentication. It means that your machine instead authenticates with an SSH key:

You generate a private/public key pair on your computer (the one you will take with you), and add the public key from that pair to a list of trusted computers on your server. When logging in, your computer will prove to the server who it is by generating that same public key. No password needed.

1. Generate a key pair with ssh-keygen -t ed25519 on you computer.
2. Copy the contents of ~/.ssh/id_ed25519.pub from you computer into a file on you server called ~/.ssh/authorized_keys.

That’s it!

The file on the server should be in the home directory of the user you want to log in as. If it already exists, add the key you generated to the end of it.

thats what I meant. I was referring to setting PasswordAuthentication to no in the sshd_config.

Tailscale should provide everything you need. Then you can use whatever remote desktop/management tools you want.

Everyone says tailscale but if you don’t want to setup an account with google or Microsoft login, Netbird is the way to go.

Or run your own headscale server, which is what I do.

Until Tailscale IPOs and starts locking the clients down, like BitWarden is doing right now.

I just use wireguard. Easy to set up, especially with something like wg-easy

Is there a step by step tutorial for this you know of?

I used wg-easy myself as I wanted a basic admin interface to manage profiles: wg-easy.github.io/wg-easy/…/getting-started/ (seems down at the moment)

Never expose the bare remote control endpoint publicly. For example, recently macOS had a critical vulnerability where an attacker could completely bypass authentication on their Screen Sharing daemon, and the researcher had estimates around 40k publicly exposed systems, and it was found out that the vulnerability was in fact being used in the wild. Exposing things like that publicly is asking for trouble.

Personally I don’t like relying on 3rd party systems like Tailscale, so I just have a WireGuard peer running firewalled to only allow access to what is necessary, though you can skip the firewall part. This obviously assumes you have a routable public IP, i.e. no CGNAT, if that’s not the case Tailscale is probably what you want.

Just set up a basic ssh connection, using key based authentication. You don’t need anything past that for a basic short term connection. I used one for years with port forwarding through my router to the ssh port on my desktop.

Now that I have a more complex setup with several services I use Tailscale and run my own Headscale server for it. But still, basic ssh will get you a long way and should be the first thing you do.

Tailscale