Have you ever had to access a device or VM behind NAT and what would you use to do it? Say a raspberry pi running a web server. Would you use port forwarding or something else?
Ask HN: What do you use for remote access?
1–10 of 57 posts
Re: Ask HN: What do you use for remote access?
#2Zerotier - https://www.zerotier.com/
Create a network with automatic IPv6 addresses and start the management access service (likely ssh) on the zt0 interface. then it "just works", regardless of NAT in between.
This is a completely userland solution however. You probably don't want to put real service traffic on it if you care about throughput. It's perfect for management however. (or just test it, maybe you can saturate your link anyway)
This works either by using the public servers for discovery, or you can set up your own dedicated endpoint(s). Either way, the traffic takes the direct route through the NATs, or within the local netowrk if possible.
Re: Ask HN: What do you use for remote access?
#3The semi-standard solution is a VPN, e.g. OpenVPN or IPsec, to an external server.
Re: Ask HN: What do you use for remote access?
#4The semi-standard solution is a VPN, e.g. OpenVPN or IPsec, to an external server.
I've got way more love for OpenVPN after learning that's how Tesla is having vehicles retrieve their firmware updates from the mothership.
Re: Ask HN: What do you use for remote access?
#5Zerotier - https://www.zerotier.com/ Create a network with automatic IPv6 addresses and start the management access service (likely ssh) on the zt0 interface. then it "just works", regardless of NAT in between. This is a completely userland solution however. You probably don't want to put real service traffic on it if you care about throughput. It's perfect for management however. (or just test it, maybe you can satu…
Great solution. The website has a crazy jiggling photo that almost made me leave.
I was going to suggest something like teamviewer or just a vpn, but this is actually a pretty neat solution that I have not seen before.
Re: Ask HN: What do you use for remote access?
#6I tunnel everything through ssh (both local and remote port forwarding) and in some cases for the exact use-case you have mentioned (web server running on a raspberry pi that is behind a NAT). It works for me.
I've never set up a VPN and I'm not too knowledgable about them. Should I set one up? I don't know. Toyed with the idea a few weeks ago up until I read this post on StackOverflow (http://serverfault.com/questions/653211/ssh-tunneling-is-fas...) - TLDR (VPNs are slow)
Re: Ask HN: What do you use for remote access?
#7autossh and reverse tunnels. like this: https://raymii.org/s/tutorials/Autossh_persistent_tunnels.ht...
Re: Ask HN: What do you use for remote access?
#8tor hidden services. slow, but secure!
Re: Ask HN: What do you use for remote access?
#9I tunnel everything through ssh (both local and remote port forwarding) and in some cases for the exact use-case you have mentioned (web server running on a raspberry pi that is behind a NAT). It works for me. I've never set up a VPN and I'm not too knowledgable about them. Should I set one up? I don't know. Toyed with the idea a few weeks ago up until I read this post on StackOverflow ( http://serverfault.com/questi…
> TLDR (VPNs are slow)
I don't think that's correct. There are multiple kinds of VPNs and multiple things that slow them down. Specifically:
- OpenVPN and other tun/tap handlers send more wrappers and suffer from slow userland networking
- SSH tunneling sends the least amount of unnecessary encapsulation / wrappers
- IPSec, wireguard and other services that do actual traffic processing in the kernel are likely to be faster than the rest, but still has some encapsulation overhead
On a slow link (sending things over internet) the packet overhead matters the most. On a local network, you should be able to saturate 100mbps even with openvpn without a lot of issues.
Out of those SSH is not a "real vpn". There's no persistence and you only get a point-to-point tunnel which needs to be started always from side behind the NAT. Also, you can't connect full networks, or make mDNS work with remote endpoints this way.
> Should I set one up?
If you need just a tunnel that you can set up on demand - probably not. If you need something more - you should definitely try a VPN instead.
Re: Ask HN: What do you use for remote access?
#10tor hidden services. slow, but secure!
Also impossible to properly firewall. By design you give the whole world the opportunity to send you traffic to forward. This does not work for any kind of professional deployment.