Access work machine from desktop reddit / selfhosted ---------------------------------------------------------------------- kitsune1324 · 2023-10-01 03:58 Work implemented a new restrictions and I'm absolutely tired of having this machine on my desk. It needs to be connected to VPN at all times and cannot be RDP/VNC into it. I'm looking for under $400 Accessed via local network Low latency at 1080p (50hz or higher) Can be accessed either like RDP or in a web browser (like Chrome remote desktop) Any recommendations or is piKVM really my best option? ---------------------------------------------------------------------- ColoradoPhotog · 2023-10-01 04:08 you're gonna need to just use a KVM. If the company has policies on RDP and VNC, and you're attempting to breach those, you're opening a door for issues under the tech policies you likely signed or agreed to when you started. I'll be the first to tell you, as someone in cybersec, that while we aren't exactly always proactively looking to bust up employees about conduct, when its clear someone repeatedly attempts bypass, we eventually send it off to managers for review. Some of them wind up in worse situations, with confidential management-lead investigations into them, email interception, desktop monitoring, etc... It's a lot of bullshit for a workaround... ---------------------------------------------------------------------- MysticalKittyHerder · 2023-10-01 04:08 TeamViewer should work ---------------------------------------------------------------------- Oujii · 2023-10-01 04:21 I would take ColorodoPhotog's advice. On the other hand, my workplace allows us to use the corporate image on VMs, so I just created a VM on Proxmox and I use the VNC feature to access it. The VNC server is not hosted on the VM itself, so nobody can know it is happening. It is a little slower than I would like, though. ---------------------------------------------------------------------- falcorns_balls · 2023-10-01 04:42 I used to use teamviewer for this. But considering it's locked to a VPN, Teamviewer would probably route through the VPN and cause latency, unless standard traffic is still flowing through your own gateway instead of the VPN. a pikvm is probably the best option. More private, better connection quality, and it would be difficult for the company to detect. ---------------------------------------------------------------------- hainguyenac · 2023-10-01 05:00 I was about to recommend you piKVM but it seems like you know about it already. I actually do the same with my work pc, but there's one problem, I can't take video calls with pikvm (or can I, do I miss anything in the document?) ---------------------------------------------------------------------- gentoorax · 2023-10-01 05:10 In regards to the VPN of its pushing all traffic over the VPN you can add your own routes to keep some traffic local. ---------------------------------------------------------------------- NotTryingToConYou · 2023-10-01 06:32 You're looking for KVM over IP. Look up TinyPilot It basically acts like a mouse, keyboard, and screen but instead relays it over IP. You shouldn't need to install anything on your work machine so it should be "undetectable" ---------------------------------------------------------------------- [deleted] · 2023-10-01 07:10 [removed] ---------------------------------------------------------------------- speculatrix · 2023-10-01 07:17 For access to online services like teams or zoom, you can run those locally. ---------------------------------------------------------------------- speculatrix · 2023-10-01 07:19 That's a good way to improve your experience by "split tunneling". Most corporate VPNs won't allow that, and it might be against policy. There's sometimes ways around the VPN client blocking local access. ---------------------------------------------------------------------- hainguyenac · 2023-10-01 07:26 Not in my case, corporate accounts can only be used within VPN. ---------------------------------------------------------------------- speculatrix · 2023-10-01 07:34 They may have setup special DNS entries that aren't visible off their network. ---------------------------------------------------------------------- jerwong · 2023-10-01 09:20 A lot of VPN clients I've worked with will disconnect the VPN if they detect any changes in the routing table. ---------------------------------------------------------------------- thundermagician · 2023-10-01 09:22 At the risk writing an unpopular opinion, circumventing your company IT and security policies is probably not a great idea . If you can't tolerate using what's provided, use feedback mechanisms and try to improve UX, otherwise change jobs. You're putting yourself and your company at risk by hacking around the "approved" remote access solution. ---------------------------------------------------------------------- jerwong · 2023-10-01 09:26 I got around this problem by setting up a dedicated box to be my VPN router and essentially turning it into a site-to-site tunnel with the client VPN. I used a Raspberry Pi but a VM or any hardware can do this. Work used either Cisco Anyconnect or Pulse Secure, both of which were compatible with OpenConnect. I established the VPN tunnel using OpenConnect which would create "kernel routes" (this works best with a split-tunnel). I then configured IPtables to NAT masquerade using the tun0 interface it created which allowed any traffic arriving at the VPN router to get NAT'd out to the company. In order to make traffic seamless, I installed Quagga, a routing daemon, and set up OSPF between my main router and the VPN router and redistributed kernel routes into OSPF. This allows any packet destined for a VPN network to get passed to the vpn router and NAT'd out. Once you do that, any computer on your network can access those resources and since there's no tunnel, you can RDP/Rustdesk/VNC/etc into your computer. ---------------------------------------------------------------------- gentoorax · 2023-10-01 10:19 There are some that only check initially. There are some that do it periodically. So it depends. Another options is to tunnel out over the vpn with a reverse ssh tunnel. It means your rdp goes over over the Internet but if your connection is fast you may not notice. You could also use corkscrew and make the ssh look like https traffic which is virtually undetectable. ---------------------------------------------------------------------- finnjaeger1337 · 2023-10-01 10:38 And this is why they have people return to the office 🤣 *Insert leaked documents from a rat that took screenshots on your personal device you use to connect to your kvm here* Honestly, Why bother i guess you want to roam around the house or garden while at work and dont want to be tied to your desk, I get that, totally but maybe instead of breaching security i would just look at kvm extenders that dont require a personal device that could be breached, something like whdmi or whatever. ---------------------------------------------------------------------- Cybasura · 2023-10-01 12:00 We have a term in cybersecurity, and these are called ShadowIT, basically people, assets that are not recorded in the inventory as well as does not follow the security policy of the company due to certain reasonings Please just follow your company's rules and security policies, if you cant do the work from the policy, then so be it, company's problem and not yours I'd recommend not even using PiKVM, because that may cause a break in the network security of your organization that basically negates any possible security your company may have had ---------------------------------------------------------------------- athornfam2 · 2023-10-01 14:09 Listen to this and don’t listen to anyone else. You are trying to break corp IT policy. Coming from someone who enforces this we pass these incidents off to the manager for “discussions” or termination depending on the severity of the incident. ---------------------------------------------------------------------- kitsune1324 · 2023-10-01 14:43 >. On the other hand, my workplace allows us to use the corporate image on VMs, so I just created a VM on Proxmox and I us Oh my god, that might actually work. The only thing I'm trying to circumvent is installing corporate software on my machine in order to access basic things, which our IT is already annoyed at. ---------------------------------------------------------------------- kitsune1324 · 2023-10-01 14:46 >e your experience by "split tunneling". > >Most corporate VPNs won't allow that, and Checked previously and they won't add an exception. VPN kills the RDP connection and routs all traffic over the vpn. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-01 15:49 > Oh my god, that might actually work. It's an interesting idea but it remains to be seen if you can actually image a laptop that's supposedly protected/encrypted. In OP's case their company provides the images themselves. ---------------------------------------------------------------------- kitsune1324 · 2023-10-01 15:53 My comment was more about trying a VM out vs imaging the corporate computer, sorry I was not clear about that ---------------------------------------------------------------------- HerbSmokington420 · 2023-10-01 15:58 I’m a security analyst, I would find what you’re doing and immediately report you as an internal threat to the company and you’d be contained from network access. Just don’t do it. ---------------------------------------------------------------------- HerbSmokington420 · 2023-10-01 15:58 Dudes just gonna end up fired lmao ---------------------------------------------------------------------- GolemancerVekk · 2023-10-01 16:55 Dayum those are some spicy prices. ---------------------------------------------------------------------- speculatrix · 2023-10-01 18:32 To break the block on split tunneling, what you might be able to do is.. on your firewall, reroute traffic destined to the corporate vpn endpoint on, say, tcp:2222 to a local machine's ssh port i.e. tcp:22 Then when you ssh to 2222 on the endpoint you get a connection to your own machine. The VPN typically only expects traffic to a few ports so you can set up a lot of redirections ---------------------------------------------------------------------- sergebuff · 2023-10-01 20:00 Cloudflare Tunnel ---------------------------------------------------------------------- kitsune1324 · 2023-10-01 20:01 Can you elaborate how that would work in this instance? ---------------------------------------------------------------------- sergebuff · 2023-10-01 20:08 A Cloudflare Tunnel (like ngrok), can be used to establish a TCP Tunnel; to expose a TCP service to the internet. You have to install a small agent on the machine. RDP is supported by using the same agent on both the consumer and host machine. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-10-01 20:32 Maybe with usb/ip or a (not selfhosted service) virtual here if you want to try it but you need to run the software directly on the computer so it may be difficult ---------------------------------------------------------------------- kitsune1324 · 2023-10-01 23:38 This is a fair point, I already have the go-ahead from IT but I have a contact in the SOC I'll reach out to as well. ---------------------------------------------------------------------- Synatix · 2023-10-02 12:08 I did something similar. I installed linux to another partition and use windows installation inside a VM(Just added a rawdisk in virtul box) So if i need to access company data i do it via the vm ---------------------------------------------------------------------- kitsune1324 · 2023-10-02 19:12 Checked today and funny enough, I have permission to do this as long as it's not accessible outside the network which works perfectly for me. ---------------------------------------------------------------------- ColoradoPhotog · 2023-10-02 19:32 awesome! Hey man, as long as you got permission thats ALLL that matters. I just like to caution people because sometimes innocent mistakes, like just trying to improve workflow, can look malicious if its bypass attempts. I've seen people who were genuinely good workers find themselves in the crosshairs of management for similar. ---------------------------------------------------------------------- Character-Profile-51 · 2023-10-26 00:34 I recommend you use Supremo; it's the best!