Is OpenVPN realistic to access home dev desktop PC?

VPN
1

I’m thinking of switching a thinkpad laptop to a MacBook Air and offload my occasional programming projects to a desktop PC at home. If I need to work on the projects away from home, I’ll openvpn (tplink archer 55 router, fixed IP address) back in and WoL the desktop (Win 10) and remote into from the MacBook. Is this a realistic set up? Would it be secure enough? My biggest fear is someone hacking into my desktop through the VPN. Thanks so much for your input!!

Edit:

Thanks so much for all the input! Much appreciated!! I did some quick search about tail scale. Would I be right in saying that I won’t be to do WoL with tailscale (but possible with wire guard)?

Edit 2:
Thanks again for all the input!! I decided to keep the Thinkpad for now because Win 11 seems to be linking to my iOS device okay. Also set up a RaspPi server and installed etherwake. Lots of suggestions for Tailscale. I think I can make that work if I install Tailscale on rasp pi, use it to wake up the dev desktop, and then Tailscale into the desktop. A bit cumbersome but sounds like Tailscale is much easier to set up - possibly more secure too?? If I wanna get more hands on, I think I’ll set up OpenVPN on the router and VPN back in, either use TAP or the Pi server to do WoL and then remote desktop. Thanks again for all your help!!

2

Do not use login/password but use a specific SSH key to allow connection (use WireGuard and it’ll work out of the box) and you’re good to go

Openvpn is used on enterprise to access the enterprise private network, so it’s a simple but working solution

3

Use tailscale or headscale, both use the more modern, than OpenVPN, Wiregaurd.

Tailscale especially is great, you can get away with the free tier.

4

Thanks so much for all the input! Much appreciated!! I did some quick search about tail scale. Would I be right in saying that I won’t be to do WoL with tailscale (but possible with wire guard)?

5

I personally switched to a M2 Pro macbook and I do not need my PC anymore. When I need to access servers, I use OpenVPN.

6

Another vote for taliscale is one of the best solutions for accessing a home network securely. I use it basically daily to access a home server, desktop, router and security camera system. Extremely easy to use and rock solid!

7

I would vote for Twingate if you haven’t taken a look. Does a lot more powerful vpn-like stuff with access controls, etc and stupidly fast performance

8

Yes it will work. But you will need to send a wol magic packet from the router on the same subnet as the machine you want to wake.

9

Zeroteir, Tailscale, Twingate or a few others

10

For home access just use tailscale

11

No.

Just use Tailscale instead. Much much easier. Tailscale.com

​

Its wireguard, without the headaches.

12

I run openwrt on my router and create ssh tunnels to local machines to whatever port I need. You can use pubkey auth for ssh, it thwarts login attemps.

13

I was trying to set up a wireguard server that could work with a DNS name instead of IP. I failed miserably. Then I came across Tailscale and felt ashamed that I even wasted time on trying to set up my own vpn server.

14

I personally switched to Wireguard:
Performance
Simplicity
Quick Connection Establishment
Roaming
Strong Encryption

15

Openvpn is used on enterprise to access the enterprise private network, so it’s a simple but working solution

OpenVPN is the complete opposite of simple, but once configured, does work very well.

16

How can tailscale be more modern than wireguard, while it runs on wireguard in the backend?

17

Tailscale uses Wireguard, which doesn’t support Layer 2 networking. Sadly I don’t think the OpenVPN in your router is running in Layer 2 mode either. Looking at the manual, it has its own subnet assigned, so that makes me believe it is running in Layer 3 mode.

Taking a look at the manual though, it looks like it supports IP & MAC Binding. I think that’s going to add a static entry in the router’s mac address table. Set that up, it will solve the layer 2 issue. Then you should be able to send the WoL packet over OpenVPN to the IP of the desktop (don’t use the broadcast address).

I don’t understand why folks are recommending Tailscale. You said your Win 10 box will be powered off (so tailscale won’t be connected). And tailscale can’t be used to send a WoL packet.

ETA: It looks like your router generates certificates/keys for OpenVPN. That’s the best scenario for security. Unless there is a flaw in your router someone would need to have the key in order to login. Just keep the router firmware updated and you should be fine.

18

Tailscale here for some home dev and family help (octogenarian support class) just works. Throw some ACLs in there and its easy peasy lots of trust on that platform but for my use case the risk vs outcome is low.

19

…both use the more modern, compared to OpenVPN, WireGuard.

20

you don’t want layer 2 vpn, it would be full of random broadcast and ARP packets. VPN should be routed.

You can TAP openvpn .

I have used openvpn and wireguard extensively. Wireguard is better and easier. Never used tailscale, to be honest I don’t really get it.