Revision history [back]

Without dismissing the effort the author of wiki/ROS/Tutorials/MultipleRemoteMachines put into that tutorial, I don't believe what is described there was ever a best practice (note: it's also not that old: first edits from end of 2018).

The tutorial essentially instructs users to setup port forwarding, which exposes ROS nodes directly on the public internet. This is not a good idea.

STEP 2: Modem/Router Settings even suggests to forward all TCP and UDP ports between 1025 and 65000. Exposing all ports of a machine to the public internet.

This is also not a good idea.

It's also unnecessary.

I would strongly recommend to use a VPN or some other form of tunnel between remote networks. This has many benefits, but two main ones:

1. all traffic will be encrypted (in contrast to plain TCPROS and UDPROS traffic, which is plain text)
2. only a single port (or a couple at most) needs to be exposed in a firewall

Whether you use a commercial service or something like tinc-vpn (OSS, peer-to-peer VPN) doesn't really matter.

As to performance: anything which needs to be encrypted and decrypted will incur overhead. But that's a non-issue here I believe, as transmitting ROS messages plain text over the public internet is basically an invitation for some rogue entity to take control of your robot(s), and additionally the types of encryption employed by VPN services are typically rather lightweight.

Without getting overly dramatic: only use port-forwarding if you absolutely cannot use something else.

Without dismissing the effort the author of wiki/ROS/Tutorials/MultipleRemoteMachines put into that tutorial, I don't believe what is described there was ever a best practice (note: it's also not that old: first edits from end of 2018).

The tutorial essentially instructs users to setup port forwarding, which exposes ROS nodes directly on the public internet. This is not a good idea.

STEP 2: Modem/Router Settings even suggests to forward all TCP and UDP ports between 1025 and 65000. Exposing all ports of a machine to the public internet.

This is also not a good idea.

It's also unnecessary.

I would strongly recommend to use a VPN or some other form of tunnel between remote networks. This has many benefits, but two main ones:

1. all traffic will be encrypted (in contrast to plain TCPROS and UDPROS traffic, which is plain text)
2. only a single port (or a couple at most) needs to be exposed in a firewall

Whether you use a commercial service or something like tinc-vpn (OSS, peer-to-peer VPN) doesn't really matter.

As to performance: anything which needs to be encrypted and decrypted will incur overhead. But that's a non-issue here I believe, as transmitting ROS messages plain text over the public internet is basically an invitation for some rogue entity to take control of your robot(s), and additionally the types of encryption employed by VPN services are typically rather lightweight.

Without getting overly dramatic: only use port-forwarding if you absolutely cannot use something else.

Without dismissing the effort the author of wiki/ROS/Tutorials/MultipleRemoteMachines put into that tutorial, I don't believe what is described there was ever a best practice (note: it's also not that old: first edits from end of 2018).

The tutorial essentially instructs users to setup port forwarding, which exposes ROS nodes directly on the public internet. This is not a good idea.

STEP 2: Modem/Router Settings even suggests to forward all TCP and UDP ports between 1025 and 65000. Exposing just about all ports of a machine to the public internet.

This is also not a good idea.

It's also unnecessary.

I would strongly recommend to use a VPN or some other form of tunnel between remote networks. This has many benefits, but two main ones:

1. all traffic will be encrypted (in contrast to plain TCPROS and UDPROS traffic, which is plain text)
2. only a single port (or a couple at most) needs to be exposed in a firewall

Whether you use a commercial service or something like tinc-vpn (OSS, peer-to-peer VPN) doesn't really matter.

As to performance: anything which needs to be encrypted and decrypted will incur overhead. But that's a non-issue here I believe, as transmitting ROS messages plain text over the public internet is basically an invitation for some rogue entity to take control of your robot(s), and additionally the types of encryption employed by VPN services are typically rather lightweight.

Without getting overly dramatic: only use port-forwarding if you absolutely cannot use something else.

Edit: I've added a strong warning to that tutorial to dissuade people from trying to implement it (diff):

I'm actually going to discuss with some other people whether that page should be removed.