posted in Selfhosted
Remote connection over internet?
I’m going to be away from home for a few weeks and would like to access my computer (LMDE) while I’m away. Remote desktop connection would be ideal, just file transfer would be acceptable.
Is a VPN necessary, or can port forwarding be good enough for a one time use?
What software/networking recommendations do you have?
Replying to @18107@aussie.zone
If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.
ssh -R 8022:localhost:22 user@relay
As long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with
ssh -p 8022 user@relay
so make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you’re gonna use unsecure protocols like VNC. First ssh to the server
ssh user@relay
next
ssh user@localhost -p 8022
or one line, especially useful when combined with -i to point at the home pc’s ssh key stored on the client
ssh -J user@relay user@localhost -p 8022
You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports
ssh -R 5901:localhost:5901 user@relay
or together
ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relay
On the client ssh with the -L flag
ssh -L 5091:localhost:5091 user@relay
Now you can connect your VNC client to
localhost:1
Replying to @qwerty@discuss.tchncs.de
Jesus… Just port forward 22 to your system and ssh in directly.
Replying to @atzanteol@sh.itjust.works
That’s not always an option and when it is, setting it up is often more complicated and less secure than using a relay server. Honestly, the fastest (to setup), easiest and most secure option would be ssh server as a tor hidden service. Everything is handled by tor out of the box, .onion domain name, nat hole punching, E2EE, port scanning bots… all taken care of, no need for opening ports, static ip, dns, ddns, fail2ban, worrying that there’s a 0 day or that you misconfigured something. No one can exploit you service if nobody knows it exists.
Replying to @qwerty@discuss.tchncs.de
Setting up ssh is nearly trivial. And saying it’s “less secure” doesn’t mean it’s insecure.
It’s the primary access point for thousands of systems and for good reason. It’s “good enough” for your little homelab.
Replying to @atzanteol@sh.itjust.works
Depends what you mean by setting up ssh. Installing sshd, sure. Opening up ports, calling your isp to buy dedicated ip if they even offer one, getting a domain, setting up ddns…
Replying to @qwerty@discuss.tchncs.de
Opening ports is also trivial. You don’t generally need a dedicated IP if you keep a connection running but YMMV. And you don’t need a domain - just remember the IP. This is only for a few weeks.
Replying to @atzanteol@sh.itjust.works
If you’re behind cgnat oppening ports on your router won’t do you any good. You have to call your isp and ask them for a dedicated public ip, usually for a price if they offer one at all. If that ip is static you can remember it, if not, you need ddns. If you’re one of the lucky few not behind cgnat then yeah, your setup will be the simplest possible, but if you are, like the majority of people these days, it’s one of the most complicated.
Replying to @qwerty@discuss.tchncs.de
Well yeah, duh.