Just use ssh and be sure to disable remote root access and require key based authentication. If it’s good enough for aws, azure, etc. then it’s good enough for what you want.

You’ll want to read up on port forwarding and pick a remote gui tool. “No machine” works very well for x11, but rdp is supported by some wayland displays. Vnc is the old workhorse.

Tailscale + Rustdesk has worked for me so far.

Simple, easy, free and just works.

Wireguard server in your home network, remote access via DDNS is the way I do it.

If you can rent a vps you can use it as a relay server. You setup sshd on your home pc and ssh to the vps with the -R flag.

ssh -R 8022:localhost:22 user@relay

As long as the connection is live you can ssh to the server via relay. If you set GatewayPorts to yes on the relay in sshd_config then it will act as an open port on your home pc and anyone will be able to connect to it over the internet with

ssh -p 8022 user@relay

so make sure to secure it correctly, only allow ssh keys etc. If you set GatewayPorts to no, then only clients connected to the relay will be able to connect to the server, this is a must have if you’re gonna use unsecure protocols like VNC. First ssh to the server

ssh user@relay

next

ssh user@localhost -p 8022

or one line, especially useful when combined with -i to point at the home pc’s ssh key stored on the client

ssh -J user@relay user@localhost -p 8022

You can also setup VNC over ssh. Add 2nd -R on home pc with vnc ports

ssh -R 5901:localhost:5901 user@relay

or together

ssh -R 8022:localhost:22 -R 5901:localhost:5901 user@relay

On the client ssh with the -L flag

ssh -L 5091:localhost:5091 user@relay

Now you can connect your VNC client to

localhost:1

Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you’re gold.

I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent’s home PC across the country to check updates and backups.

Fast, easy, free, and secure.

Answering on the idea of port forwarding. Though like others have said, tailscale or similar is a better option.

Opening an ssh port would allow file transfer. You could also so remote desktop with port forwarding over ssh and vnc (or some other more modern protocol, haven’t futzed with anything like that in a long time).

Probably doesn’t need saying but make sure your system is up to date. Also using a nonstandard port and using key based authentication and disallowing password authentication and good security measures. If the device you’re connecting from isn’t something you’re bringing with you, you’d also need a copy of your private key.

Wireguard

Port forwarding is moderately simple but there are risks to just opening a port and not guarding it with appropriate firewall rules. This includes an SSH server if not up-to-date.

Whereas setting up something like Tailscale on your machine and on your laptop is exceedingly straightforward, avoids firewall reconfigurations, and Just Works™. You could then connect to whatever service you have running, just as if you were on your LAN. My only gripe is that you do need a Google/Microsoft/GitHub/Apple account or OIDC to set up.

In the long term, if you have misgivings about that company operating the coordination server necessary for this tunneling solution, then there’s always the open-source Headscale, which is a drop-in replacement.

Tailscale is easier and has a generous free tier, Netbird is free and has more features

If you set up one port forward to any SSH server on your local network (e.g., a spare Raspberry Pi), you can then use SSH tunneling to mirror any port on any machine in your local network to ports on your remote SSH client. And it leaves no trace on either side outside of the terminal session.