RDP to home pc without VPN. Guacamole + Authelia? reddit / selfhosted ---------------------------------------------------------------------- stickscaper · 2023-12-08 13:15 I used to have local admin rights on my work laptop. Because I have a lot of downtime at work I installed Wireguard client to VPN to my home network and rdp into my home pc. I follow a course where I need a lot of installed tools that I dind't want to install on my work laptop. Last week the IT department made some changes disabling local admin rights and the wireguard client. Of course this is a good thing from a sysadmin pov but for me it cripples my ability to progress my coursework from my home pc as I can't access it anymore. I'm thinking of ways to get around this without installing anything on my work laptop. Right now I've set up an Apache Guacamole server on my home network. I want to open this to the open internet so I can just access my pc from the browser. Ideally I'd lock this behind a vpn but thats not possible anymore. Would this be a wise choice? I'm thinking of sticking a service like Authelia in front of this to handle 2fa. Also I read about crowdsec, and cloudflare tunnels I could use to route to my home network. For the Wireguard VPN I just used duckdns and opened the wireguard port on my router. I'm hesistant to just straight up open up guacamole to the outside so I'm looking for your advice on how to do this in the most secure way possible. The server is running Debian 12 and Guacamole using the 3 official docker images (guacamole, guacd and mysql). Thank you! ---------------------------------------------------------------------- thekrautboy · 2023-12-08 13:52 Do not circumvent any protections that your employer placed on their network and do not install anything on company-provided devices that you are not explicitly allowed to. If you continue, bookmark /r/LegalAdvice already. Why do we have a post like this every two weeks here... ---------------------------------------------------------------------- stickscaper · 2023-12-08 13:54 This is why I'm trying to use guacamole. So I'm not installing anything on my work computer, I just access the webpage from my browser. ---------------------------------------------------------------------- New_d_pics · 2023-12-08 13:57 What about a bootable usb drive via [Ventnoy](https://www.ventoy.net/en/index.html) and preload with wireguard and guac or whichever rdp ---------------------------------------------------------------------- stickscaper · 2023-12-08 14:01 I feel like this would intensely violate the IT policy of my work. I don't want to mess with their laptop too much. And aside from that I don't have a BIOS password which I would probably need to load an alternative boot device. Thanks for the suggestion though! ---------------------------------------------------------------------- stickscaper · 2023-12-08 14:09 Also, to reply to your edits: The downtime is expected and my boss doesn't care what I do in the downtime at work and they know about this. It's just IT not allowing anybody to install stuff on a work laptop which is perfectly reasonable. I'm thinking the guacamole route is the safest way to not compromise or privesc the work laptop but still being able to access my remote pc through a browser website. I've read online about people using Nginx reverse proxy + authelia so make this set up more secure. ---------------------------------------------------------------------- thekrautboy · 2023-12-08 14:30 > I've read online about people using Nginx reverse proxy + authelia to make this set up more secure. As i suggested yes. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-08 14:50 caddy and authelia work great for me. With guac it already supports 2fa so you could remove authelia from the equation altogether if you wanted. It is handy to have though for other services you may want access to. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-08 14:57 Whilst that would work. Its risky for a number of reasons. The first being you would need to reboot and run something on a work network that isn't secure in the same way. Doing that would also mean they couldn't use the computer for the purpose it was setup. The op wants to continue to work and also do other things during downtime on that same machine whilst still doing what that machine is for. ---------------------------------------------------------------------- junkleon7 · 2023-12-08 14:57 Look into docker webtops. I use it behind nginx proxy manager + authelia. ---------------------------------------------------------------------- rkpjr · 2023-12-08 15:03 Maybe look into CloudFlare Tunnels. ---------------------------------------------------------------------- notorioustubze · 2023-12-08 15:18 I have Cloudflare set up on my guacamole instance. Connect right to it via a web browser and then have access to all my VM’s via rdp. Works perfectly ---------------------------------------------------------------------- g-nice4liief · 2023-12-08 16:06 I have a reverse proxy in front of my guacamole container that works togheter with authelia. I use traefik with authelia as a middleware. ---------------------------------------------------------------------- habskilla · 2023-12-08 16:11 when all else fails, there is always chrome remote desktop via the web app. ---------------------------------------------------------------------- arcadianarcadian · 2023-12-08 16:16 Guacamole + nginx or any reverse proxy + Authelia does the job. Not just RDP but SSH/VNC also. ---------------------------------------------------------------------- uncmnsense · 2023-12-08 17:36 i am playing around with ipv6 and really liking it. its all the access of what it feels like to be on a vpn except without the vpn. in your router you will have to allow for incoming ipv6 traffic but on your work computer you just use the ipv6 address given to your home machine (dont share that address with anyone!) and rdp to it like youre sitting right next to it. i have used this in the past and it works like a charm! takes some time getting used to the address structure, but it just a copy + paste and not that hard. ---------------------------------------------------------------------- BCIT_Richard · 2023-12-08 18:28 Are you using Cloudflare Zero Trust Tunnels? I run everything this way and feel like I should configure it in a better way, but don't know how. ---------------------------------------------------------------------- notorioustubze · 2023-12-08 18:41 Yeah Cloudflare tunnels. What is worrying about your configuration? ---------------------------------------------------------------------- BCIT_Richard · 2023-12-08 19:51 I manually map my subdomains to the port in the tunnel, I feel like I should be pointing to a reverse proxy and have it handle that for me, I'm just not sure how to set it up properly, every guide I've looked at only confused me rather than clarify anything. ---------------------------------------------------------------------- AdrianTeri · 2023-12-08 20:00 Got me thinking about something else... Windows users how's uptime in your world dealing with \*windows updates\*? Have you "crippled" to conduct any updates while you're away? Do you use something like PiKVM? ---------------------------------------------------------------------- nefarious_bumpps · 2023-12-09 00:11 >The downtime is expected and my boss doesn't care what I do in the downtime at work and they know about this. Your boss might not care, but has he actually given written approval for you to connect to an outside network or device? Does your boss have the authority to approve the connection? Usually, infosec has to approve the connection, and netops has to setup and monitor the connection. Aside from arbitrary security policies, your company might be subject to legislative or regulatory standards, or have standards imposed by it's cyber-insurance. If guacamole allows file transfers between your company laptop and the remote network or device -- and it seems it does -- it would probably be considered a circumvention of security controls (DLP, IPS) and violation of company policies. I think a better solution would be to use a personal laptop with whatever tools and VM's are needed for your coursework, and connect that to your company's guest network or your phone's mobile hotspot if Internet access is needed. Just my opinion from an infosec/management perspective. ---------------------------------------------------------------------- Impressive-Cap1140 · 2023-12-09 00:12 Cloudflare is the reverse proxy ---------------------------------------------------------------------- EvilEyeV · 2023-12-09 02:16 I currently use guacamole via cloudflare tunnel. Guacamole has a module for totp so I use that for MFA. ---------------------------------------------------------------------- Spaceman_Splff · 2023-12-12 00:22 I have router/firewall - IPS - reverse proxy- authentik (proxy) - guacamole. Works great. Have crowdsec or fail2ban somewhere along the way and you are golden.