tychoish/rhizome/remote-accessibility-reverse-tunneling-super-dynamic-dns/ discourse

discourse

I'd have been tempted to use an ssh remote-port tunnel, so that a specified port on localhost at the server is tunnelled to port 80 on localhost on your laptop; then use a proxy on the web server to forward things to the specified port on localhost so it gets tunnelled, and then put logging/access control in the remote web server as appropriate.

But VPNs are useful too :-)

What kind of VPN are you using? An old-school PPTP/L2TP, or a shiny modern N2N / tinc peer-to-peer jobby?

-- Alaric

So the SSH session idea is really great, mostly because it's simple, until:

  • you realize that it's terribly slow because ssh lags horribly because it's TCP-based for everything that requires network throughput.

  • you realize that it's not quite so simple because if your laptop is moving around all the time, it's not exactly trivial to get a connection outgoing from your server to your laptop, without a lot of fussing (and probably NAT exceptions.) SSH tunnels aren't bi-directional, and all. :)

I'm doing the OpenVPN thing, which I guess counts as old school. I've been called worse!

-- tychoish

  • Aye, ssh's performance isn't great.

  • Oh, you ssh from the laptop to the web server, bypassing all NATs on the way - you use "ssh -R" rather than "ssh -L" to create the port forward! It makes the sshd listen on a port, and then the connection is forwarded from your ssh client, rather than the other way around.

-- Alaric

I've posted a little before about my tablet IMAPS problems -- how even places that have free and open WiFi are blocking IMAP/IMAPS, which makes using my tablet with my private cloud email rather difficult. I also have some services running at home that I want to keep firmly behind my firewall, but which I increasingly often want to access from my tablet. After reading this rhizome, I've given in and configured OpenVPN on my home server. After a bit of growling at SELinux, I managed to get it to do more or less everything I want. It's a lot more convenient than setting up ssh tunnels for everything I wanted to use.

-- jfm

As near as I can tell, to get OpenVPN clients working on one has to root on the Android device, which is something I haven't gotten around to doing, I must confess. Good to know how that goes.

There's nothing (much) that you can do with OpenVPN that you couldn't do with SSH and some cleverness, and there are situations where SSH is preferable. Having said that, in most cases for serious and regular use OpenVPN is a lot less fussy.

-- tychoish

Archos is nice in that their ROM supports OpenVPN out of the box. My tablet is rooted for other reasons, but it wasn't necessary for this. But if your vendor isn't as helpful, you'll need root to us the third party apps. I think ipsec or pptp should work on most non-rooted devices.

After a little bit of use, I'm extremely happy with how OpenVPN is working here.

--jfm