Security of accessing my home PC with dynamic DNS

Question

I want to access my home PC when I am outside. I know this can be done using dynamic DNS (ex. DynDNS), but my question is around the security of doing so.

If I was to set this up today, I will have to configure my Linksys E3000 router to allow external connections in to the local network. Will the firewall of this router be enough against hackers in this case?

Is it better to build a custom router which will provide better security? (ex. Untangle, smoothwall, Astaro .. etc) Will this make it safer?

Answer 1

The only way you can be sure your computer cannot be hacked via the Internet is to not connected it to the Internet.

That said...

I assume you're wanting to connect to you computer with Remote Desktop Connection or SSH.

With either of these options, you'll need to forward port 3389 (for RDC) or 22 (SSH) for connections coming from your router's public IP address to your home PC.

Once you've done this, any and all connections from the outside world will be able to connect to your local machine. The security is now the responsibility of the application listening on the forwarded port.

It doesn't make any difference if you're using a dynamic domain name service or not. If a connection is attempted to your IP addresss (regardless of domain name) on the forwarded ports then those connections will get through.

If your router allows port forwarding for only connections coming from specific IP addresses then "any and all connections form the outside world" should be limited to those specific IP addresses.

Answer 2

The Dynamic DNS piece has no real security implications, so I wouldn't worry about that.

Your Linksys should be sufficiently secure for protecting a "normal" home network, but if you have data of extra sensitivity on there I would perhaps add extra layers of security, for example I only allow external connections into a DMZ, with a very limited range of connectivity from there to the internal network.

You do need to configure the router to only let in the specific ports you require, and what I would do is only allow SSH (anything else you do can be tunnelled over SSH anyway) as this can provide strong authentication (using certs or shared secrets) and end to end encryption.