I think he wants a machine that can do local LLM

You use ssh to manage a multi node VPN?

You shouldn’t open a port on your router.

Connect from your home to a public VPS and connect your public devices to that VPS.

"Should" and "shouldn't" are dependent on context. In this case, that somewhat depends on what the router you're using is, how much you trust it, and your ISP's configuration. Opening a port isn't an inherently insecure thing, it's a choice that you make while being aware of the tradeoffs between that port being exposed to the internet at large and wanting a given service to be available.

What's the advantage of adding a VPS to the mix?

Having a VPS gives you a static, non-shared, stable IP with a whois that doesn’t resolve to a residential ISP.

Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.

In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.

It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.

Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?

This is frankly a bit nonsensical. "In a workplace setting, connecting to your residential IP will raise suspicions or alarms." - so will connecting to literally any unexpected VPN endpoint if the network is halfway competently monitored.

Just because your VPN endpoint is on a VPS somewhere rather than a computer on your home network doesn't make it any more secure, and the scare mongering here that somehow a home router will drastically mess up a function as simple as forwarding traffic coming in on a port to another machine is weird... if you don't trust it to do that then I'd get rid of the thing because that's its entire job.

I used Nebula extensively.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.

No.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard.

Wireguard is the building block for higher level tools like Tailscale to build on.

Doing ssh through port 80 or 53 or 443 is immediately flagged.

I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https

Flagged by who? The Internet Police? This comment is absurd.

By restricted networks, like hospitals, workplaces, schools, etc.

If their firewalls can detect it not being typical http/s traffic, they can block it.

I run WireGuard VPN on port 443 UDP. Many times I can connect to that from various public WiFi networks like coffee shops and public libraries. And then I ssh into my machines at home over my self-hosted VPN.

I’ve been hoping that HTTP3 adoption would make 443 UDP accessible from even more places. But maybe they already do the kind of thing you said for that too, looking at the traffic flow to determine that it is not HTTPS.

Weirdly sometimes there are WiFi networks where I am not able to connect to my WireGuard VPN on 443 UDP, but I can connect to servers over ssh on standard port 22 TCP. Perhaps they sometimes block all UDP traffic because they don’t want people to use BitTorrent etc, but one would think that with all the online meeting platforms that do video streaming there would be a lot of problems for people if all UDP traffic was blanket blocked.

I might eventually try out AmneziaWG instead of vanilla WireGuard, but at the moment I am fine not being able to Connect to my VPN sometimes. I only use it to connect to my other machines anyway, not as a VPN tunnel for my web browsing etc.

it's possible commercial routers such as the ones utilized by restaurants allow wireguard through these days? wireguard makes no effort to be stealthy when emitting.

some VPN apps bypass wireguard blocks automatically by using https tunnels and whatnot.

Does mosh help with it? Seems to be based on udp, and it looks good. I am not entirely sure if it helps the issue that you are talking about so hoping for someone more experienced to chime in

https://mosh.org/

It worked in 2008 - 18 years ago. I have other options now like said cloudflare tunnel.

A lot of networks still just do dumb port blocking. Yes, any network that is making a serious effort to prevent ssh will succeed. But a lot aren't.

I think you're likely attributing too much competence to the kind of place that restricts outbound traffic to 80 and 443 in the first place.

Naive. There's not much that prevents you from running ssh over https. Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

It will absolutely and trivially be detected by any decent IDS/IPS

SSH does nothing to hide it is SSH (tho "I'm just https" mode would certainly be welcome addition)

> Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

SSH is dead simple to detect, because the server sends an outbound greeting in ASCII text; and the client doesn't send anything until it gets the greeting. The binary protocol does not look like a TLS stream at all either.

Even with corporate MITM setups? I somehow doubt it..

MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you?

Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.

No need for MITM.

DPI immediately can tell it is ssh.

No, by DPI. SSH has recognizable signature as does web sockets etc.

Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI

"Naive”. How ironic.

I work in a unioned environment. I use AI.

My boss would never dream asking I crank more because I now have AI help.

That guy saying there were only two possible outcomes doesn’t know about the beauty of unions.

"My boss would never dream asking I crank more because I now have AI help."

But... You're cranking more right? I mean, she may give you the courtesy of not asking for more as you (and we collectively) figure this out, but it's getting quite clear that you can crank more, so why would she not expect it?

Sure there may be a union, but if you're the only person not cranking out more with AI, there can still be consequences.

you're fortunate; the power of unions has been decimated since the 80s, and huge efforts have been made by companies (with the support of the government) to prevent new industries from unionizing

Far from every comments.

There’s a lot of yous…

You were satisfied with the level of understanding the person you replied to provided.

That person was then politely told to rtfa and given more substance than they thought was in there.

And what did you do?

That’s quite ironic.