Live data from Hacker News

Ask HN: What do you use for remote access?

news.ycombinator.com

11–20 of 57 posts

Re: Ask HN: What do you use for remote access?

#11
I was using a combination of a VPN and NAT rules to do so. Basically, machine A (the machine behind the firewall I want to connect to) would connect to machine B (a VPS or AWS instance - free tier micro instances are awesome for that matter!) using a VPN connection (pptp or openvpn or l2tp or whatever - pptp has the advantage of being super easy to setup and working out of the box on most linux distros. Not the most secured though, but to run SSH on it, it's good enough). I had a script to periodically check (every 1 minute or so) if the VPN connection was up and if not, try to reconnect. Then, I had some iptables NAT forwarding rules on machine B (let's call it gateway) to send all TCP traffic on a defined port to the machine A, port 22, using the VPN interface.

It had the advantage of being quite easy to setup for me as I'm quite used to setup VPNs and NAT forwarding rules (for having living in China, bypassing firewalls is almost an everyday routine exercise :) Also, it worked perfectly well and the performances were reasonable. I could access my server at home, in Beijing, behind a NAT, a dynamic IP and the country's firewall, from anywhere in the world. I was happy!

There are surely other (better?) ways to do it though, and the autossh/reverse tunnels option looks very interesting.

Re: Ask HN: What do you use for remote access?

#13
post #8

tor hidden services. slow, but secure!

Also impossible to properly firewall. By design you give the whole world the opportunity to send you traffic to forward. This does not work for any kind of professional deployment.

Untrue, there are options to set a key so that no-one who doesn't have the key can even contact the onion service.

Re: Ask HN: What do you use for remote access?

#14

Earlier quoted context omitted.

Also impossible to properly firewall. By design you give the whole world the opportunity to send you traffic to forward. This does not work for any kind of professional deployment.

Untrue, there are options to set a key so that no-one who doesn't have the key can even contact the onion service.

If I understand what you mean correctly, you end up with just a private onion network. What's the gain in that case over setting up a dedicated VPN network instead?

Re: Ask HN: What do you use for remote access?

#16

Port forwarding, reverse SSH tunnel or Tor onion service. All three for more reliability.

That's not how reliability works. If you use 3 different layers that the traffic needs to pass through, you have 3 different layers that can fail. That means less reliability, not more.

Re: Ask HN: What do you use for remote access?

#17
probably tmi but any / all of the following: - SSH (direct or tunnels) - VNC (usually over ssh or VPN) - RDP (usually over ssh or VPN) - VPN (openvpn or ipsec) - MicroTik Router at home with site-to-site VPN to my DC and Office - Mobile Hotspot (always a must when traveling) - Last resort: Dial direct with 56.6kbps modem to DC when there is an internet uplink failure or DDoS attack.

Re: Ask HN: What do you use for remote access?

#18
The easiest to setup should be port-forwarding on the router. If you trust putting your server on the internet, then that's the way to go.

But it really depends on the use-case. HTTP from behind NAT - that's easy, just port-forward. If you're talking about SSH access, then you have a few more options that you might want to explore (port forward, or tunneling to an external host). If you're talking more than one host behind the NAT, then you have another set of possible solutions (reverse-proxy HTTP servers, SSH gateways, etc...).

Care to give us more information?

Post reply on HN