I’m going to be away from home for a few weeks and would like to access my computer (LMDE) while I’m away. Remote desktop connection would be ideal, just file transfer would be acceptable.
Is a VPN necessary, or can port forwarding be good enough for a one time use?
What software/networking recommendations do you have?
Just set up a basic ssh connection, using key based authentication. You don’t need anything past that for a basic short term connection. I used one for years with port forwarding through my router to the ssh port on my desktop.
Now that I have a more complex setup with several services I use Tailscale and run my own Headscale server for it. But still, basic ssh will get you a long way and should be the first thing you do.
Never expose the bare remote control endpoint publicly. For example, recently macOS had a critical vulnerability where an attacker could completely bypass authentication on their Screen Sharing daemon, and the researcher had estimates around 40k publicly exposed systems, and it was found out that the vulnerability was in fact being used in the wild. Exposing things like that publicly is asking for trouble.
Personally I don’t like relying on 3rd party systems like Tailscale, so I just have a WireGuard peer running firewalled to only allow access to what is necessary, though you can skip the firewall part. This obviously assumes you have a routable public IP, i.e. no CGNAT, if that’s not the case Tailscale is probably what you want.
Everyone says tailscale but if you don’t want to setup an account with google or Microsoft login, Netbird is the way to go.
Or run your own headscale server, which is what I do.
I just use wireguard. Easy to set up, especially with something like wg-easy
Is there a step by step tutorial for this you know of?
I used wg-easy myself as I wanted a basic admin interface to manage profiles: https://wg-easy.github.io/wg-easy/latest/getting-started/ (seems down at the moment)
Tailscale should provide everything you need. Then you can use whatever remote desktop/management tools you want.
just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.
This is probably a dumb question, but as someone who has never fucked with SSH, is there anything that I need to do to my basic Linux install to make sure randos cannot do what you just described (without permission)?
When they say “password auth disabled” they don’t mean being ble to log in without authentication. It means that your machine instead authenticates with an SSH key:
You generate a private/public key pair on your computer (the one you will take with you), and add the public key from that pair to a list of trusted computers on your server. When logging in, your computer will prove to the server who it is by generating that same public key. No password needed.
- Generate a key pair with
ssh-keygen -t ed25519on you computer. - Copy the contents of
~/.ssh/id_ed25519.pubfrom you computer into a file on you server called~/.ssh/authorized_keys.
That’s it!
The file on the server should be in the home directory of the user you want to log in as. If it already exists, add the key you generated to the end of it.
- Generate a key pair with
tailscale. and then use vnc(tigervnc-server or x11vnc) and ssh
Tailscale + Rustdesk has worked for me so far.
Simple, easy, free and just works.
This!
Make sure to enable connect with IP in Rustdesk, and use the ip supplied by Tailscale when your not home.
Easy!
(If you use linux, make sure to use X11 rather than Wayland on your session to allow unattended connections)
You have several options.
First important question, though: what type of router do you have? If you own your own router, instead of using the one provided by your ISP, then you may have additional options.
- Tailscale VPN - Quick and easy setup. “Just works”. Creates an environment like your computers are connected to the same network. Requires setup on each device. Some limits on free plan.
- *Wireguard VPN (router host) - Configuration required at the router. Only remote devices need additional setup; devices at home don’t need individual config. *Must be supported by router
- SSH tunnel - Ideal for terminal only, though X11 forwarding is possible. Requires either a router that has an SSH server, or port forwarding. Not recommended to allow username/password-only auth; should configure for key-based auth (rsa256/ed25519) only
- Secure Remote Desktop (hosted service) - TeamViewer and similar services provide remote desktop access through account-based login, using their relays. Theoretically secure but susceptible to account takeover attacks.
- Secure Remote Desktop (direct connect or self-hosted service) - Relay-less (e.g. NoMachine) and self-hosted relay (e.g. RustDesk) provide secure, self managed remote desktop. Requires router port forwarding or reverse-proxy configuration at the router.
There are other options (like OpenVPN or Wireguard hosted on a device internal to the network, rather than the router) but I personally recommend one of the above 5 options depending on your use case and risk profile.
If you travel a lot, consider purchasing a travel router (eg GL-iNet devices). Once configured, they act as a repeater or access point for your devices, including forwarding all traffic over a VPN. You arrive at your destination, plug in the travel router, use its webUI to connect it to the hotel or guest Wi-Fi of your choice, and then connect all your personal devices to its Wi-Fi network. No need for connecting every device to a new network at each destination. They support captive portal login, AdGuard Home baked in, blocking all non-VPN traffic, and more.
This is very sound advice. Pretty similar to my infrastructure. The gl-inet travel router already with wireguard to VPN into my home network is one of the best decisions I’ve ever made.
Right? Especially when I had symmetric gigabit (rip marital home before divorce) it was such a game changer. Still great with 1000/50 docsis just not quite as great lol
It also took me a bit to realize GL-iNet is just a custom openwrt stack and you can reach the luci console for advanced tinkering :3
Access to the Luci ui is the reason I bought the first one I got 😁
My router is running OpenWRT (and stopped having intermittent issues after replacing the stock OS).
I’m leaning toward Tailscale for the “quick and easy” recommendation. If I need to do this again, I might try something a little more advanced.
If you’re already running OpenWRT then I personally recommend Wireguard over tailscale if you have the time. It’s not hard to set up at all and takes the third party out of the loop. OpenWRT has excellent support for Wireguard configuration and export of configs to the devices you want to connect (install client, import config). The only “gotcha” is needing DynamicDNS (assuming you don’t have a static public IP)
Tailscale is definitely super-simple but this IS the self-hosted community ;D I always prefer removing third parties at every opportunity.
This is why I ask humans instead of AI. I didn’t consider router level options.
I’ve already got dynamic DNS set up, and I’ve been meaning to set up a way to access my NAS from out of the house. This might be the final push I need.
Brave of you to assume I’m human.
…I mean, I am human, but it’s brave to assume
😂
One obstacle you might encounter is carrier-grade NAT or CGNAT. Some ISPs put residential subscribers behind an additional layer of IPv4 NAT, which makes your public address inaccessible from the internet. In that case, you’ll either need Tailscale or a similar service, or a VPS to act as a relay.
Then there’s Vodafone who have unilaterally removed both the port-forward feature and bridge mode from their residential cable modems, and I hate them, and wish them a hammer to balls.
They removed BOTH? what in the… portforwarding is a pretty basic feature to have, and i would switch ISP if they took away Bridge Mode from me.
They removed almost every basic networking feature with a firmware update. Even in “expert mode”, all I can do is set up the wifi and pick a single /24 network from 192.168.0.0/16. I can’t even pick a goddamn DNS server. Unfortunately the other ISPs that serve my area are at least twice as expensive.
Wow. An ISP going down the route of enshittification by taking away networking basics is not something that i would have expected years ago, but nowadays i am only sad about it.
My ISP wants me to swap out my modem, but as long as it works i won’t do so - i fear they might take away my (officially dynamic, but only changing once in a blue moon when they make changes in their network topology) IPv4 address and stick me back behind the awful CGNAT they have as they did once without asking years ago.
Please note that the Tailscale binaries for OpenWRT are pretty large (even if you cross-compile them with compact and strip). Your router might not have enough storage for it.
If that’s the case, you might work around it by only storing the
tailscaledbinary on persistent storage, because that’s the daemon which runs the actual connectivity. Thetailscalebinary is only used for making configuration changes, you can copy that to RAM disk, use it to set config params, then delete it.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point CGNAT Carrier-Grade NAT DNS Domain Name Service/System ISP Internet Service Provider NAS Network-Attached Storage NAT Network Address Translation SSH Secure Shell for remote terminal access VNC Virtual Network Computing for remote desktop access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
10 acronyms in this thread; the most compressed thread commented on today has 14 acronyms.
[Thread #129 for this comm, first seen 15th Oct 2026, 09:50] [FAQ] [Full list] [Contact] [Source code]
Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you’re gold.
I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent’s home PC across the country to check updates and backups.
Fast, easy, free, and secure.
If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.
ssh -R 8022:localhost:22 user@relayAs long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with
ssh -p 8022 user@relayso make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you’re gonna use unsecure protocols like VNC. First ssh to the server
ssh user@relaynext
ssh user@localhost -p 8022or one line, especially useful when combined with -i to point at the home pc’s ssh key stored on the client
ssh -J user@relay user@localhost -p 8022You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports
ssh -R 5901:localhost:5901 user@relayor together
ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relayOn the client ssh with the -L flag
ssh -L 5091:localhost:5091 user@relayNow you can connect your VNC client to
localhost:1Jesus… Just port forward 22 to your system and ssh in directly.
That’s not always an option and when it is, setting it up is often more complicated and less secure than using a relay server. Honestly, the fastest (to setup), easiest and most secure option would be ssh server as a tor hidden service. Everything is handled by tor out of the box, .onion domain name, nat hole punching, E2EE, port scanning bots… all taken care of, no need for opening ports, static ip, dns, ddns, fail2ban, worrying that there’s a 0 day or that you misconfigured something. No one can exploit you service if nobody knows it exists.
Setting up ssh is nearly trivial. And saying it’s “less secure” doesn’t mean it’s insecure.
It’s the primary access point for thousands of systems and for good reason. It’s “good enough” for your little homelab.
Depends what you mean by setting up ssh. Installing sshd, sure. Opening up ports, calling your isp to buy dedicated ip if they even offer one, getting a domain, setting up ddns…
Opening ports is also trivial. You don’t generally need a dedicated IP if you keep a connection running but YMMV. And you don’t need a domain - just remember the IP. This is only for a few weeks.
If you’re behind cgnat oppening ports on your router won’t do you any good. You have to call your isp and ask them for a dedicated public ip, usually for a price if they offer one at all. If that ip is static you can remember it, if not, you need ddns. If you’re one of the lucky few not behind cgnat then yeah, your setup will be the simplest possible, but if you are, like the majority of people these days, it’s one of the most complicated.
Well yeah, duh.
Wireguard
Just use ssh and be sure to disable remote root access and require key based authentication. If it’s good enough for aws, azure, etc. then it’s good enough for what you want.
You’ll want to read up on port forwarding and pick a remote gui tool. “No machine” works very well for x11, but rdp is supported by some wayland displays. Vnc is the old workhorse.
Port forwarding is moderately simple but there are risks to just opening a port and not guarding it with appropriate firewall rules. This includes an SSH server if not up-to-date.
Whereas setting up something like Tailscale on your machine and on your laptop is exceedingly straightforward, avoids firewall reconfigurations, and Just Works™. You could then connect to whatever service you have running, just as if you were on your LAN. My only gripe is that you do need a Google/Microsoft/GitHub/Apple account or OIDC to set up.
In the long term, if you have misgivings about that company operating the coordination server necessary for this tunneling solution, then there’s always the open-source Headscale, which is a drop-in replacement.
If you’re gonna use an overlay network like Tailscale I would highly recommend also taking a look at netbird. Similar concept, but fully self hostable if the need arises (but not recommended unless you have a specific need).
will recommend. just use Tailscale. you may distrust any of these OIDC providers, but that doesn’t mean they can see your traffic. long term if you’re paranoid move to Wireguard or Headscale, but this is so simple it’s a no-brainer
