LeBit

I think he wants a machine that can do local LLM

Having a VPS gives you a static, non-shared, stable IP with a whois that doesn’t resolve to a residential ISP.

Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.

In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.

It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.

Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?

No need for MITM.

DPI immediately can tell it is ssh.

"Naive”. How ironic.

You use ssh to manage a multi node VPN?

You shouldn’t open a port on your router.

Connect from your home to a public VPS and connect your public devices to that VPS.

I used Nebula extensively.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.

No.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard.

Wireguard is the building block for higher level tools like Tailscale to build on.

Doing ssh through port 80 or 53 or 443 is immediately flagged.

I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https

I work in a unioned environment. I use AI.

My boss would never dream asking I crank more because I now have AI help.

That guy saying there were only two possible outcomes doesn’t know about the beauty of unions.

Far from every comments.

There’s a lot of yous…

You were satisfied with the level of understanding the person you replied to provided.

That person was then politely told to rtfa and given more substance than they thought was in there.

And what did you do?

That’s quite ironic.

And if residents are saying they are driven crazy by the constant horns, forget about them. They don’t matter. Remember: only you matter.

Why aren’t you sandboxing your agent?