Hacker News Reader

Comment by benbristow | Hacker News Reader

Not 100% open source, but a good solution for controlling my parent's laptop when they need a hand with something (they live in England, I live in Scotland) is to use ZeroTier to set up a VPN (installed it on their laptop when I had physical access to it, uses basically no system resources and just runs in the background automatically) and then use RDP built into Windows (I installed Windows 10 Enterprise on their laptop when I first set it up, have loads of MSDN keys from work).

https://www.zerotier.com/

Works really, really well and doesn't try to wrongfully block me for 'commercial usage' like Teamviewer does.

View on HN

Bitvise SSH Server for Windows is also free for personal use, if you'd rather just forward the RDP port securely.

Not sure about Bitvise SSH server, thanks for the recommendation though, is that Zerotier works behind firewalls. Don't need to do any port forwarding etc. Very similar to Logmein's Hamachi.

Since their laptop is usually on WiFi behind an ISP-provided router/modem combo this is ideal. Also don't need to force a static IP on the network so the port forwarding rules align properly.

As I say, we're in different countries so this is very handy, it "just works".

Also is secure as nobody can jump onto the virtual network without explicit whitelisting on ZeroTier's Web UI. You have to login (with 2FA) and click a checkbox to allow access if anyone wants to join.

RDP nowadays uses TLS.

True! My recommendation is influenced by 2019's https://en.wikipedia.org/wiki/BlueKeep Microsoft RDP remote code execution vulnerability.

Another alternative is to install an SSH client and setup an automatic connection with your server (using a password-less key). Just forward RDP and don't let the user open a shell. I think that's possible via ForceCommand in the sshd config [1]. So if the client machine is hacked, your server will not be compromised.

Disclaimer: I didn't test this, so no guarantee it's 100% secure. Specifying no-pty or Command in the authorized_keys files doesn't seem enough, though.

[1] https://askubuntu.com/questions/48129/how-to-create-a-restri... Check the accepted answer.

Zerotier is my goto tool too(I use tightvnc server even on Windows instead of RDP)!

But the downside is that they had downgraded everyone in the free tier to only 1 hosted network, which is sad since now I can't do different groups.

I used to have a group for each circle of friends so that we can play LAN games together and now I need to ask one of them from each group to set a network themselves for me to join.

Self hosting (Moon instances) introduced basically nothing since our network wasn't super reliable. With their current pricing it wasn't that useful to us so I'm now in a love-hate relationship with Zerotier.

Is this downgrade a recent change?

Looking at their pricing page the limit is listed as 25 networks (didn't this used to be 50?).

https://www.zerotier.com/pricing

Reply on news.ycombinator.com