Best, most secure way to access home network from outside?

[Ghiddy]

I have a decent router and a small home network with a mix of Linux and Windows machines. I want to be able to access the Linux machines from outside world via SSH at least (possibly VNC for GUI remote desktop later on). I also want to be able to RDP into the windows machines.

I already set up SSH on the linux boxes and SSH into them from other PC's within the home network. Same with windows RDP; already set that up and can access that from other PC's within home network.

I know that I will have to set up a dynamic DNS service, and then configure my router to link up to the Dynamic DNS service. But my question is what is the best as most secure way to access each individual PC from from outside? Should I just set up port forwarding for each machine/service tuple? i.e.

dynamic.IP.com:1234 -> home_linux_box_01:22
dynamic.IP.com:1235 -> home_linux_box_02:22
dynamic.IP.com:1236 -> home_windows_box_01:<RDP Port>

I know that the first thing to do is put SSH onto a non default port to dissuade attackers. I really don't like the idea of having any of those ports open though, because even if I change to a non default port, wont attackers eventually find the open ones through their port scanning? After they find the open ports, they can stick to that one and try their brute force attacks. How do I protect against that? I read that key files are better than passwords, for Linux SSH. I don't understand what those are or how they work though. And is there an equivalent for windows RDP?

I think one solution is to have a router that supports VPN. I think mine does, it is a SonicWall, but I think you have to pay extra for the VPN client. Can anyone confirm that?

I'd also rather not assume that any of the PC's is always on, because that would become a single point of failure. Maybe in the future I would get a dedicated remote access machine that I use as a point of entry to access my home LAN from the outside, but that is not something I want to do right now. Don't want to spend any money on this if at all possible.

 

[kenzo]

I use teamviewer for remote access which works well and is free.

 

[ViviTheMage]

For SSH, private key is the way to go. I did not read this entire link, but at first glane, it looked right :

http://www.ualberta.ca/CNS/RESEARCH/LinuxClusters/pka-putty.html

or how to forge :

http://www.howtoforge.com/ssh_key_based_logins_putty

 

[Emulex]

dd-wrt supports vpn. $20 routers can rock that. PPTP does quite fine and doesn't require separate subnet. just assign the pptp server to 192.168.1.2 (192.168.1.1 is router) and give range of say 192.168.1.3 to 10 for remote clients. done. easy peasy. everything on the planet supports pptp. except bonjour

 

[Aarondeep]

The simplest solution I did was replace my proprietary router and move to an open source solution like openVPN.

I setup a box with IPCOP and then installed an OpenVPN addon. It was really easy to setup, I just followed this how-to:

http://thinkhole.org/wp/2006/03/28/ipcop-openvpn-howto/

 

[Ghiddy]

The simplest solution I did was replace my proprietary router and move to an open source solution like openVPN.

I setup a box with IPCOP and then installed an OpenVPN addon. It was really easy to setup, I just followed this how-to:

http://thinkhole.org/wp/2006/03/28/ipcop-openvpn-howto/

To make sure I understand, you have a PC acting as your router/firewall, yes?

I'm not sure I want to do that at the moment. I'd rather stick with a lower power and smaller specialized device.

 

[Ghiddy]

Update: I think I solved the issue for now. I was only able to test access from the outside by tethering to my cell phone, and that worked. I didn't have to enable port forwarding, so I feel like this is the most secure solution I could have gotten.

My router supports SSL-VPN, so I configured that. My IP is also about 99&#37; static (seems to only change if my MAC changes), but I set up a dynamic DNS just in case. The router has an SSL web page that I can log into from any PC on the net. I used a custom port for that to obscure it a little. Once logged in, it lets you download and install a VPN client (which works on Windows 7 x64 BTW). You don't need to have the browser window open once it's set up. I used the most secure password I could generate.

Once I'm logged in to the SSL-VPN it is basically like being on my home network. I can see and access all the devices & PC's on my home LAN. This is nice for me because I have several machines there and I didn't want to have to set up port forwarding for each one. So I can RDP into my win machines, and SSH into my linux ones. I can even print to my printer!

I disabled access to the router management interface via SSL-VPN for added security.

 

[Aarondeep]

To make sure I understand, you have a PC acting as your router/firewall, yes?

I'm not sure I want to do that at the moment. I'd rather stick with a lower power and smaller specialized device.

Yeah I have mine installed on a PC, however its a low power device using a atom mini-ITX machine, I havent measured it but i think it pulls like 25 watts.

Your solution works as well, I would consider that time saved over what I was suggesting =)

 

[JackMDS]

The free UltraVNC has a AES encryption module.

http://www.uvnc.com/index.html

AES is just as safe (if not more) than VPN, SSH, etc.

Install the VNC on the computer.

Put a copy of the Viewer and the encryption key on a USB Flash Drive.

Configure the AES with its Key.

Open through the Home Router the VNC's port (use a port in the 60000 instead of the 5900 default).

You connect from the outside by typing into the viewer

Your External IP (or dynamic.IP.com)ort number

Should take 20 min. to set the computer and it is remotely yours from any Internet connection on the planet.

http://www.ezlan.net/vnc.html

 

[Ghiddy]

The free UltraVNC has a AES encryption module.

http://www.uvnc.com/index.html

AES is just as safe (if not more) than VPN, SSH, etc.

Install the VNC on the computer.

Put a copy of the Viewer and the encryption key on a USB Flash Drive.

Configure the AES with its Key.

Open through the Home Router the VNC's port (use a port in the 60000 instead of the 5900 default).

You connect from the outside by typing into the viewer

Your External IP (or dynamic.IP.com)ort number

Should take 20 min. to set the computer and it is remotely yours from any Internet connection on the planet.

http://www.ezlan.net/vnc.html

Seems interesting. I prefer VPN because it gives me access to my entire home LAN in one step. I'm not that well versed in SSH and tunneling and stuff that I can accomplish that with access through a single PC. One of the things I mentioned in the OP is I didn't want to rely on any of my current PC's as a point of entry. I might do that if I had a low power dedicated device, but I don't. Well actually I do, that's what my router is for.

 

[LiuKangBakinPie]

OpenVPN is sort of a easier Ipsec without the hard way to set it up.
Its advantages of SSL/TLS and the security advantages of Ipsec. You can tunnel straight thru with a encrypted tunnel. Just make the keys config 2 lines in the config of it and off you go. Its as secure as you can get with 256 AES.

 

[chuck2002]

Great idea with the VPN. I am going to look into doing this at my house instead of my current SSH access.