I’m going to be away from home for a few weeks and would like to access my computer (LMDE) while I’m away. Remote desktop connection would be ideal, just file transfer would be acceptable.
Is a VPN necessary, or can port forwarding be good enough for a one time use?
What software/networking recommendations do you have?
Port forwarding is moderately simple but there are risks to just opening a port and not guarding it with appropriate firewall rules. This includes an SSH server if not up-to-date.
Whereas setting up something like Tailscale on your machine and on your laptop is exceedingly straightforward, avoids firewall reconfigurations, and Just Works™. My only gripe is that you do need a Google/Microsoft/GitHub/Apple account or OIDC to set up.
In the long term, if you have misgivings about that company operating the coordination server necessary for this tunneling solution, then there’s always the open-source Headscale, which is a drop-in replacement.
will recommend. just use Tailscale. you may distrust any of these OIDC providers, but that doesn’t mean they can see your traffic. long term if you’re paranoid move to Wireguard or Headscale, but this is so simple it’s a no-brainer
If you’re gonna use an overlay network like Tailscale I would highly recommend also taking a look at netbird. Similar concept, but fully self hostable if the need arises (but not recommended unless you have a specific need).
just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.
This is probably a dumb question, but as someone who has never fucked with SSH, is there anything that I need to do to my basic Linux install to make sure randos cannot do what you just described (without permission)?
When they say “password auth disabled” they don’t mean being ble to log in without authentication. It means that your machine instead authenticates with an SSH key:
You generate a private/public key pair on your computer (the one you will take with you), and add the public key from that pair to a list of trusted computers on your server. When logging in, your computer will prove to the server who it is by generating that same public key. No password needed.
- Generate a key pair with
ssh-keygen -t ed25519on you computer. - Copy the contents of
~/.ssh/id_ed25519.pubfrom you computer into a file on you server called~/.ssh/authorized_keys.
That’s it!
The file on the server should be in the home directory of the user you want to log in as. If it already exists, add the key you generated to the end of it.
thats what I meant. I was referring to setting
PasswordAuthenticationtonoin the sshd_config.
- Generate a key pair with
I guess depends on the risk factor you want to take. For me I’d go VPN. You could go port forwarding, or you could even do something like temporarally use something like anydesk depending if you want to trust a corporation for remote access.
Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you’re gold.
I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent’s home PC across the country to check updates and backups.
Fast, easy, free, and secure.
Tailscale is easier and has a generous free tier, Netbird is free and has more features
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CGNAT Carrier-Grade NAT DNS Domain Name Service/System ISP Internet Service Provider NAS Network-Attached Storage NAT Network Address Translation SSH Secure Shell for remote terminal access VNC Virtual Network Computing for remote desktop access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
[Thread #129 for this comm, first seen 15th Oct 2026, 09:50] [FAQ] [Full list] [Contact] [Source code]
Take a look at Yggdrasil.
Wireguard server in your home network, remote access via DDNS is the way I do it.
Wireguard
If you just set up one port forward to any SSH server on your local network, you can then use SSH tunneling to mirror any port on any machine in your local network to ports on your remote SSH client—no additional setup or software needed.
That sounds…not…smart…
Why? It sounds fine to me. OpenSSH is the standard for secure remote access. And port forwarding works great.
I think it’s fine. Want to explain why you think that it’s an issue?
Tailscale
If you want a full complete remote desktop solution, you should probably look at VNC and portforwarding its port. I think it’s 3001.
Or if you won’t (or can’t) mess with port forwards, you could setup something like RustDesk for the TeamViewer experience.
3001
5900
Answering on the idea of port forwarding. Though like others have said, tailscale or similar is a better option.
Opening an ssh port would allow file transfer. You could also so remote desktop with port forwarding over ssh and vnc (or some other more modern protocol, haven’t futzed with anything like that in a long time).
Probably doesn’t need saying but make sure your system is up to date. Also using a nonstandard port and using key based authentication and disallowing password authentication and good security measures. If the device you’re connecting from isn’t something you’re bringing with you, you’d also need a copy of your private key.
OpenSSH is one of the most secure applications in the world. It’s fine to expose it to the Internet. Just be sure you have excellent passwords or don’t allow password auth.
If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.
ssh -R 8022:localhost:22 user@relayAs long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with
ssh -p 8022 user@relayso make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you’re gonna use unsecure protocols like VNC. First ssh to the server
ssh user@relaynext
ssh user@localhost -p 8022or one line, especially useful when combined with -i to point at the home pc’s ssh key stored on the client
ssh -J user@relay user@localhost -p 8022You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports
ssh -R 5901:localhost:5901 user@relayor together
ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relayOn the client ssh with the -L flag
ssh -L 5091:localhost:5091 user@relayNow you can connect your VNC client to
localhost:1If you don’t want to keep the ssh/vnc connection live the whole time, you can setup port knocking or have a script that periodically monitors some website, email, a file hosted on the relay server etc. for a signature or encrypted nonce + password, that when received will cause the home pc to open connection to the relay.
Jesus… Just port forward 22 to your system and ssh in directly.
That’s not always an option and when it is, setting it up is often more complicated and less secure than using a relay server. Honestly, the fastest (to setup), easiest and most secure option would be ssh server as a tor hidden service. Everything is handled by tor out of the box, .onion domain name, nat hole punching, E2EE, port scanning bots… all taken care of, no need for opening ports, static ip, dns, ddns, fail2ban, worrying that there’s a 0 day or that you misconfigured something. No one can exploit you service if nobody knows it exists.
Setting up ssh is nearly trivial. And saying it’s “less secure” doesn’t mean it’s insecure.
It’s the primary access point for thousands of systems and for good reason. It’s “good enough” for your little homelab.
Depends what you mean by setting up ssh. Installing sshd, sure. Opening up ports, calling your isp to buy dedicated ip if they even offer one, getting a domain, setting up ddns…
Opening ports is also trivial. You don’t generally need a dedicated IP if you keep a connection running but YMMV. And you don’t need a domain - just remember the IP. This is only for a few weeks.
If you’re behind cgnat oppening ports on your router won’t do you any good. You have to call your isp and ask them for a dedicated public ip, usually for a price if they offer one at all. If that ip is static you can remember it, if not, you need ddns. If you’re one of the lucky few not behind cgnat then yeah, your setup will be the simplest possible, but if you are, like the majority of people these days, it’s one of the most complicated.
Just set up a basic ssh connection, using key based authentication. You don’t need anything past that for a basic short term connection. I used one for years with port forwarding through my router to the ssh port on my desktop.
Now that I have a more complex setup with several services I use Tailscale and run my own Headscale server for it. But still, basic ssh will get you a long way and should be the first thing you do.
