Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you use for remote access?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 57 posts

Re: Ask HN: What do you use for remote access?

#21

Post by Scarbutt »

viraptor wrote: post #9
stuxnet79 wrote: post #6

I tunnel everything through ssh (both local and remote port forwarding) and in some cases for the exact use-case you have mentioned (web server running on a raspberry pi that is behind a NAT). It works for me. I've never set up a VPN and I'm not too knowledgable about them. Should I set one up? I don't know. Toyed with the idea a few weeks ago up until I read this post on StackOverflow ( http://serverfault.com/questi…

> TLDR (VPNs are slow) I don't think that's correct. There are multiple kinds of VPNs and multiple things that slow them down. Specifically: - OpenVPN and other tun/tap handlers send more wrappers and suffer from slow userland networking - SSH tunneling sends the least amount of unnecessary encapsulation / wrappers - IPSec, wireguard and other services that do actual traffic processing in the kernel are likely to be…

OpenSSH has support for VPNs so you can connect two networks, although they do mention that for permanent VPNs you should use something else.

Re: Ask HN: What do you use for remote access?

#23

Post by xarope »

Use case is important, to determine what resources+tools you have access to/can deploy.

However, assuming this device/VM runs "unix", and to K.I.S.S., use reverse SSH tunnelling. Once an SSH tunnel is established on your side, you can do whatever you want... e.g. tunnel VNC through for GUI.

You can of course add more layers of security e.g. non-standard SSH port, dedicated VM/server for the SSH entry point, refresh SSH keys regularly etc.

Re: Ask HN: What do you use for remote access?

#25

Post by saynsedit »

viraptor wrote: post #14
mynameislegion wrote: post #13

Earlier quoted context omitted.

Untrue, there are options to set a key so that no-one who doesn't have the key can even contact the onion service.

If I understand what you mean correctly, you end up with just a private onion network. What's the gain in that case over setting up a dedicated VPN network instead?

In theory, the connection between the client and the server would be anonymous.

Re: Ask HN: What do you use for remote access?

#27

Post by whisk3rs »

viraptor wrote: post #10
whisk3rs wrote: post #8

tor hidden services. slow, but secure!

Also impossible to properly firewall. By design you give the whole world the opportunity to send you traffic to forward. This does not work for any kind of professional deployment.

This depends on what you mean by "properly" and "impossible" and "professional" and "forward".

Many professional name-brand corporations use Tor daily.

The only ports opened are those you configure to have onion services. Port limiting is one of the major features of firewalls.

You don't get to control source IP ranges, but those aren't generally trustworthy on the open internet anyway.

Also, the traffic isn't "forwarded" -- hidden services shouldn't be run on a relay, actually, so you're not forwarding anybody's traffic but your own.

Also, barring the recent attacks on discovery of onion services, connecting to a tor onion service allows you stronger security guarantees and MitM defense than TCP+DNS+IP routes.

Re: Ask HN: What do you use for remote access?

#29

Post by Jimidy »

For VNC-style full desktop access, Teamviewer just works...it runs on Windows and Linux, is very fast, and (usually) doesn't need any special firewall/NAT rules set up. I believe on Windows at least, it can be used to establish a VPN as well.

Might be overkill if you just need to reach one particular service (e.g. HTTP(S)) though, in which case you could consider setting up a reverse proxy (e.g. using nginx) on a DMZ'd server?

Post reply on HN