Selfhosted

Tailscale

You have several options.

First important question, though: what type of router do you have? If you own your own router, instead of using the one provided by your ISP, then you may have additional options.

1. Tailscale VPN - Quick and easy setup. "Just works". Creates an environment like your computers are connected to the same network. Requires setup on each device. Some limits on free plan.
2. *Wireguard VPN (router host) - Configuration required at the router. Only remote devices need additional setup; devices at home don't need individual config. *Must be supported by router
3. SSH tunnel - Ideal for terminal only, though X11 forwarding is possible. Requires either a router that has an SSH server, or port forwarding. Not recommended to allow username/password-only auth; should configure for key-based auth (rsa256/ed25519) only
4. Secure Remote Desktop (hosted service) - TeamViewer and similar services provide remote desktop access through account-based login, using their relays. Theoretically secure but susceptible to account takeover attacks.
5. Secure Remote Desktop (direct connect or self-hosted service) - Relay-less (e.g. NoMachine) and self-hosted relay (e.g. RustDesk) provide secure, self managed remote desktop. Requires router port forwarding or reverse-proxy configuration at the router.

There are other options (like OpenVPN or Wireguard hosted on a device internal to the network, rather than the router) but I personally recommend one of the above 5 options depending on your use case and risk profile.

If you travel a lot, consider purchasing a travel router (eg GL-iNet devices). Once configured, they act as a repeater or access point for your devices, including forwarding all traffic over a VPN. You arrive at your destination, plug in the travel router, use its webUI to connect it to the hotel or guest Wi-Fi of your choice, and then connect all your personal devices to its Wi-Fi network. No need for connecting every device to a new network at each destination. They support captive portal login, AdGuard Home baked in, blocking all non-VPN traffic, and more.

Just set up a basic ssh connection, using key based authentication. You don’t need anything past that for a basic short term connection. I used one for years with port forwarding through my router to the ssh port on my desktop.

Now that I have a more complex setup with several services I use Tailscale and run my own Headscale server for it. But still, basic ssh will get you a long way and should be the first thing you do.

Wireguard

tailscale. and then use vnc(tigervnc-server or x11vnc) and ssh

I just use wireguard. Easy to set up, especially with something like wg-easy

Everyone says tailscale but if you don't want to setup an account with google or Microsoft login, Netbird is the way to go.

Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you're gold.

I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent's home PC across the country to check updates and backups.

Fast, easy, free, and secure.

Port forwarding is moderately simple but there are risks to just opening a port and not guarding it with appropriate firewall rules. This includes an SSH server if not up-to-date.

Whereas setting up something like Tailscale on your machine and on your laptop is exceedingly straightforward, avoids firewall reconfigurations, and Just Works(tm). You could then connect to whatever service you have running, just as if you were on your LAN. My only gripe is that you do need a Google/Microsoft/GitHub/Apple account or OIDC to set up.

In the long term, if you have misgivings about that company operating the coordination server necessary for this tunneling solution, then there's always the open-source Headscale, which is a drop-in replacement.

Tailscale + Rustdesk has worked for me so far.

Simple, easy, free and just works.

Never expose the bare remote control endpoint publicly. For example, recently macOS had a critical vulnerability where an attacker could completely bypass authentication on their Screen Sharing daemon, and the researcher had estimates around 40k publicly exposed systems, and it was found out that the vulnerability was in fact being used in the wild. Exposing things like that publicly is asking for trouble.

Personally I don't like relying on 3rd party systems like Tailscale, so I just have a WireGuard peer running firewalled to only allow access to what is necessary, though you can skip the firewall part. This obviously assumes you have a routable public IP, i.e. no CGNAT, if that's not the case Tailscale is probably what you want.

just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you're not giving some silicon valley company full access to your home network nor are you affected by their services outages.

If you set up one port forward to any SSH server on your local network (e.g., a spare Raspberry Pi), you can then use SSH tunneling to mirror any port on any machine in your local network to ports on your remote SSH client. And it leaves no trace on either side outside of the terminal session.

Tailscale is easier and has a generous free tier, Netbird is free and has more features

If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.

ssh -R 8022:localhost:22 user@relay

As long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with

ssh -p 8022 user@relay

so make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you're gonna use unsecure protocols like VNC. First ssh to the server

ssh user@relay

next

ssh user@localhost -p 8022

or one line, especially useful when combined with -i to point at the home pc's ssh key stored on the client

ssh -J user@relay user@localhost -p 8022

You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports

ssh -R 5901:localhost:5901 user@relay

or together

ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relay

On the client ssh with the -L flag

ssh -L 5091:localhost:5091 user@relay

Now you can connect your VNC client to

localhost:1

I guess depends on the risk factor you want to take. For me I'd go VPN. You could go port forwarding, or you could even do something like temporarally use something like anydesk depending if you want to trust a corporation for remote access.

Wireguard server in your home network, remote access via DDNS is the way I do it.

Answering on the idea of port forwarding. Though like others have said, tailscale or similar is a better option.

Opening an ssh port would allow file transfer. You could also so remote desktop with port forwarding over ssh and vnc (or some other more modern protocol, haven't futzed with anything like that in a long time).

Probably doesn't need saying but make sure your system is up to date. Also using a nonstandard port and using key based authentication and disallowing password authentication and good security measures. If the device you're connecting from isn't something you're bringing with you, you'd also need a copy of your private key.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

10 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

[Thread #129 for this comm, first seen 15th Oct 2026, 09:50] [FAQ] [Full list] [Contact] [Source code]