Comparing two ways to access home network remotely

Question

I go from location to location sometimes and I want to be able to access my resources from my home network like SMB shares or my ProxMox server. Obviously, since these services are on my LAN, I cannot access them if I am not on the network.

Would it be generally more secure to set up a proper SSH shell with a publicly forwarded port (firewall, fail2ban, changing ports, and other SSH security methods), or to set up a VPN server on my LAN and VPN into my home network from my computer and access my resources that way?

Answer 1

A SSH Server and a VPN Server accomplish two different things.

SSH is intended to allow you access to a server. Port forwarding is nice for some resources, but not for everything. If your resources can be accessed by HTTP, SCP or SFTP, they work fine. SMB over SSH performance isn't good, and anything using UDP over SSH will have terrible performance.

VPN, on the other hand, will put you inside the local network, so you can access anything as if you where physically there. It's usually more difficult to setup, but gives you better access and better performance.

Security-wise, both depend on how you login on the solution you choose. Both SSH with password authentication and VPN with client certificates are very secure. Using fail2ban to secure the system is a good idea.

On the other hand, VPN would mean anything compromising your workstation would have full access to your local network, while using SSH it would only mean malware having access to any resource you have port forwarding set.