What is KVM over IP? Remote access with GL.iNet Comet

KVM over IP lets you regain access to a computer when Windows gets stuck during an update or Linux fails to boot after a sudden power loss. A separate device gives you a view of the screen and control of the keyboard and mouse before the operating system starts, when AnyDesk or SSH is unavailable. Using the GL.iNet Comet PoE and Comet Pro as examples, we’ll explain how to connect a KVM to a home node, NAS, or desktop PC, turn the computer on remotely, and secure remote access.

How KVM over IP works

KVM stands for Keyboard, Video, Mouse. A conventional KVM switch lets you use one monitor, keyboard, and mouse with several computers. KVM over IP sends video and control commands over a network through a separate device connected to the computer.

Comet connects to the computer via HDMI and USB. It captures the HDMI video signal, encodes it in H.264, and streams it to a browser or app. Over USB, the computer recognizes Comet as a keyboard and mouse and receives input just as it would from ordinary peripherals. You can also use this USB connection to mount an ISO image as virtual media, boot the computer from it, and install an operating system.

You don’t need to install remote access software or special Comet drivers on the computer you want to control. The device captures video from the computer’s output and sends input over USB, so it works with Windows, Linux, macOS, and FreeBSD, as well as BIOS/UEFI before the OS starts. During the initial setup, check that your computer sends video to the required output and accepts USB keyboard input while booting.

How KVM over IP differs from TeamViewer, AnyDesk, and RDP

Remote access software runs inside the operating system. To connect, the OS must boot, the computer must have network access, and the relevant application or service must be running. If the computer shows a blue screen error, freezes during an update, or waits for a BitLocker recovery key, your usual remote connection will no longer work. BitLocker is Windows drive encryption; certain system changes can trigger a request for a recovery key before the OS starts. These tools also cannot give you access to the GRUB boot menu, a disk check before startup, or BIOS/UEFI settings.

KVM over IP lets you see these screens and interact with them: enter BIOS, choose another kernel in the bootloader, enter a disk decryption password, or boot an installation image. A KVM user has the same screen, keyboard, and mouse access as someone sitting at the computer, so both the device and the connection to it need protection appropriate to that level of control. BIOS passwords and encryption on a locked drive still apply.

How KVM over IP differs from IPMI and iDRAC

Server motherboards often have a dedicated remote management controller, or BMC. Solutions such as Dell iDRAC and HPE iLO use this controller to provide console access and power control; IPMI is also used for server management. Ordinary PCs, mini PCs, and many home servers lack such a controller, so an external KVM over IP device can add remote access to their screen, keyboard, and mouse. You need a compatible video output and a free USB port, with a separate solution for power control.

Comet has an HDMI video input, so a computer with only DisplayPort needs a DisplayPort-to-HDMI adapter. Before installing the device at a remote location, check that the adapter works with your hardware and displays BIOS/UEFI correctly.

The GL.iNet Comet range: how the models compare

GL.iNet, best known for its portable OpenWrt routers, began making KVM over IP devices in 2025. The original Comet (GL-RM1) has 8 GB of onboard storage, some of which is used by the system. That can leave too little space for a large ISO image, including some Ubuntu Desktop releases. Comet PoE and Comet Pro each have 32 GB of eMMC storage, allowing them to hold larger installation images.

The range also includes Comet 5G (GL-RM10RC), with 64 GB of storage and a cellular modem. It supports 5G RedCap—a reduced-capability version of 5G for devices with moderate bandwidth needs—and 4G LTE, so it can work outside 5G coverage. Here we’ll focus on Comet PoE and Comet Pro, which connect to an existing network and differ mainly in their power options, Wi-Fi support, and HDMI monitor output.

Comet PoE (GL-RM1PE): for racks and wired networks

Comet PoE suits a server cabinet or another location that already has Ethernet cabling. PoE (Power over Ethernet) carries both data and power over one network cable from a compatible PoE switch or injector. The device supports 802.3af/at. Without PoE, you can power it through USB-C at 5 V / 2 A; a power adapter is not included.

The device has a quad-core ARM Cortex-A53 processor, 1 GB of DDR3L RAM, and 32 GB of eMMC storage. It streams video at up to 4K resolution and 30 frames per second and supports Gigabit Ethernet and two-way audio. The manufacturer specifies a read speed of around 35 MB/s for the internal storage and power consumption below 5 W for the KVM itself.

Comet PoE has neither Wi-Fi nor an HDMI output for a monitor. If the KVM occupies the computer’s only HDMI output, you’ll need an HDMI splitter to connect a monitor at the same time. You can use another video output on the computer instead, but check display mirroring and video output during startup. This is usually straightforward for a server without a monitor; for a desktop PC, plan the connections in advance.

Comet Pro (GL-RM10): Wi-Fi and an HDMI monitor output

Comet Pro is convenient for a home or work PC. Its main differences from the PoE version are dual-band Wi-Fi 6, an HDMI output for a monitor, and a 2.22-inch touchscreen.

You can connect Comet Pro between the computer and its monitor: the person at the PC works as usual, while you see the same screen remotely and can help them. Wi-Fi removes the need for a network cable, and switching between Ethernet and Wi-Fi can help maintain access if one connection fails. If both use the same router and internet provider, you still need a separate internet connection for backup.

The touchscreen menu lets you configure Wi-Fi, check the IP address, and enable or disable the cloud service. Set a screen lock password immediately so that someone with physical access cannot change these settings through the touchscreen.

The hardware platform matches Comet PoE: Cortex-A53, 1 GB of DDR3L RAM, 32 GB of eMMC storage, and video up to 4K at 30 frames per second with hardware H.264 encoding. The manufacturer measured the advertised 30–60 ms latency on a local network, so response time over the internet also depends on routing, bandwidth, and connection stability.

Comet Pro comes with a power adapter and has no built-in PoE support. To power it from a PoE switch, use a compatible splitter with a separate USB-C power output.

Accessories: the ATX board and Fingerbot

A KVM carries video and keyboard and mouse input, but it cannot press the power button on its own. If the computer is off or has frozen and no longer responds to Ctrl+Alt+Del, you’ll need an additional device to turn it on or force a restart remotely.

The GL-ATXPC ATX board connects to the Power and Reset button pins on the motherboard and to Comet over USB. Once connected, you can use Accessories → ATX Power to simulate a short or long press of Power or a press of Reset. This works with desktops and custom-built servers that provide access to those pins. The wiring diagram is in the ATX board guide.

The GL-FGB-01 Fingerbot mounts beside a button and presses it with a mechanical arm. It is useful for a mini PC, laptop, or NAS when connecting to motherboard pins is difficult or impossible. To control it through Comet, you need the included Bluetooth USB receiver, which plugs into the KVM’s USB-A port. Before installation, check that Fingerbot can press the button and has enough mounting space; follow the connection procedure in the Fingerbot guide.

To turn the computer on without extra accessories, you can use Wake-on-LAN, which starts it after receiving a special network packet. Enable the feature in the motherboard and network adapter settings; supported power states depend on the hardware. Wake-on-LAN cannot restart a frozen system.

When KVM over IP is useful

• Nodes and validators. Bitcoin nodes running Umbrel or Start9, Lightning nodes, and Ethereum validators usually operate without a monitor. SSH, which provides remote command-line access, is enough for maintenance when the system has booted and is connected to the network. If a failure happens earlier, a KVM lets you open the console and begin troubleshooting without traveling to the server. Keeping validator downtime short also reduces missed attestations, or votes on the network, and the resulting loss of rewards.
• Home servers and NAS. A KVM gives you access to the boot screen and settings when the server’s web interface no longer opens. For a NAS, check in advance that it has a compatible video output and supports a USB keyboard.
• A parent’s computer. With Comet Pro, the person at the computer and the person helping remotely see the same image on their screens. You can therefore help even when the OS has not booted and TeamViewer cannot start.
• A remote office, warehouse, or store. Access to a point-of-sale PC, video surveillance server, or other compatible equipment lets you investigate a failure without visiting the site. With an ATX board or Fingerbot connected, you can also force the computer to restart.

KVM during power outages

After power returns, a computer may stay off if automatic startup is not configured in BIOS/UEFI. Depending on the manufacturer, the setting may be called Restore on AC Power Loss, AC Back, or After Power Failure. To make the computer start when power returns, select Power On or the equivalent option listed in the motherboard manual. Check this before setting up remote access.

A KVM helps when the computer turns on but stops at a disk check, an error message, or another prompt requiring user input. If it does not start automatically, Comet with an ATX board or a correctly mounted Fingerbot lets you press the power button remotely and watch the boot process.

For remote access, the KVM, router, and other network equipment need power and a working internet connection. For example, you can connect the router, PoE switch, and Comet PoE to a UPS—an uninterruptible power supply—or a portable power station. Calculate runtime for the entire setup, including any equipment supplied by your internet provider that is installed on your premises. The computer also needs power; otherwise, you cannot start or service it.

Connecting Comet and completing the initial setup

Connect and secure the device on your local network first, then configure access over the internet. The web interface section names below follow the documentation for firmware 1.10; settings may be arranged differently in other versions.

1. Connect HDMI and USB. Connect the computer’s HDMI output to Comet’s HD IN port, and a USB port on the computer to the KVM’s USB-C port designated for keyboard and mouse input. Do not confuse it with the power input. On Comet Pro, connect a monitor to HD OUT if needed.
2. Connect power and the network. For Comet PoE, use Ethernet from a compatible PoE switch, or a separate USB-C 5 V / 2 A power supply with a regular Ethernet connection. For Comet Pro, connect the included power adapter, followed by the network cable. To use Wi-Fi, swipe from right to left on the touchscreen, open Wi-Fi, and connect to your network. On the first boot, set a screen lock password when Comet Pro prompts you.
3. Open Comet’s web interface. Connect your laptop or PC to the same network. You can find Comet Pro’s IP address on its screen and Comet PoE’s address in the router’s connected device list. Enter the address in your browser; on the first login, create a long, unique administrator password and save it in a password manager. Check that the console opens and shows the computer you want to control.
4. Update the firmware. Click the version number in the top-right corner of the interface and check for updates. For a manual update, download stable firmware for your exact model from the official download center and use Local Upgrade. After the device restarts, reopen the console and check the installed version number.
5. Enable two-factor authentication. In the web interface, open Settings → Security → 2FA. Scan the displayed QR code with an authenticator app, or enter the text key into the app, click Next, and confirm the setup with a code from the app. Once finished, test logging in again with your password and a one-time code.
6. Check BIOS/UEFI access. Restart the computer during a suitable maintenance window. In the remote console, press the BIOS/UEFI setup key for your computer model. Check that you can see the display and that the keyboard responds. Then exit without changing any settings and wait for the system to boot.
7. Set up one of the remote access methods described below and test the connection from another network, such as a mobile internet connection.

Ways to access Comet remotely

GL.iNet Cloud and the GLKVM app. Once the device is linked to a cloud account, you can access it through a browser or the app for Windows, macOS, iOS, or Android. This usually requires no port forwarding. The connection depends on the manufacturer’s infrastructure being available, and the security of the cloud account affects every KVM linked to it. You also use the device’s administrator password to log in to the KVM itself.

Tailscale. This service connects devices in an encrypted private network without opening inbound ports on the router. Comet has built-in Tailscale support, and access is limited to the users and devices permitted by your network’s rules. For personal use, you can start with the free plan after checking its current terms. This is convenient for a home node or server that you need to access from your own devices.

To connect Comet through Tailscale, follow these steps from the manufacturer’s guide:

1. In Comet’s web interface, open Apps Center → Tailscale, enable the service, and click Bind Device.
2. Sign in to your account on the Tailscale page and click Connect to approve adding the KVM. Check that a device named glkvm appears under Machines.
3. Install Tailscale on the laptop or phone you will use to control the computer, and connect it to the same private network.
4. Copy the IP address Tailscale assigned to your KVM, open it in your browser, and sign in to Comet with the administrator password and your configured second factor. Test access over mobile data or another external network.

Your own server. GL.iNet also lets you host the remote access backend on your own Linux server; its stated minimum requirements are two CPU cores and 2 GB of RAM. This uses your infrastructure instead of the manufacturer’s cloud, but you are responsible for configuring, updating, and securing the server. Consider this option if you already have a VPS—a rented virtual private server—and experience administering it.

Port forwarding on the router. We do not recommend exposing the KVM’s web interface directly to the internet: automated scanners can discover it, while attackers can target the login page and exploit firmware vulnerabilities. A private network with restricted access reduces the number of users and devices that can reach the KVM interface.

KVM vulnerabilities: what researchers found in Comet

In March 2026, Eclypsium published research into the security of low-cost KVM over IP devices. Researchers found four vulnerabilities in the original Comet, GL-RM1: inadequate certificate validation and firmware authenticity checks, weak protection against password guessing, and a service UART console accessible without a password. Exploiting the last issue required physical access to the board inside the enclosure.

On April 15, 2026, GL.iNet published a security advisory covering the fixes. It lists version 1.8.2 as the fixed release for GL-RM1 and also identifies Comet PoE, Comet Pro, and Comet 5G among the devices with affected firmware. Install the latest stable firmware for your model to receive subsequent security fixes as well.

The manufacturer separately documented CVE-2026-5959: a factory reset could leave the device linked to its previous owner’s cloud account. If you buy a used Comet, confirm that it has been removed from the other account, then update and configure the device again.

How an attacker could gain access to a KVM

An attacker could gain access through the KVM itself, the local network, the cloud infrastructure, or your account. During setup, consider who can physically reach the equipment and which devices you will use to control it.

• Physical access. Someone could take the device, change its connections, or try to use its service interfaces. This is particularly relevant in shared offices and rooms without access controls.
• A compromise of the manufacturer’s infrastructure. An attack on the cloud or update server creates a risk for connected devices. Tailscale or your own server can replace GL.iNet Cloud for remote access, but you still obtain firmware from the manufacturer.
• An attack from the local network. An infected laptop, vulnerable IP camera, or unauthorized device on Wi-Fi can attack the KVM interface if network rules allow it to connect.
• A compromised account, laptop, or phone. Phishing, reused passwords, or session theft can give an attacker access to GL.iNet Cloud or your Tailscale network. The laptop or phone you use to control the KVM also needs protection.

Settings to secure your KVM

• Current stable firmware. Check for updates at least once a month and install security fixes for your model.
• A long, unique administrator password that you do not use for other services.
• Two-factor authentication on the KVM itself. Comet supports one-time codes through Google Authenticator, Authy, or another compatible TOTP app.
• Secure remote access accounts. If you sign in to Tailscale through Google, Microsoft, GitHub, or another sign-in provider, enable two-factor authentication on that account. If the service supports FIDO2, use a hardware security key; our guide to choosing a YubiKey explains the differences between models. For GL.iNet Cloud, check and enable the authentication options available for that account.
• Restricted access through a private network. In Tailscale, allow only the users and devices that need access to connect to the KVM. If you do not use GL.iNet Cloud, disable it in the Cloud settings; on Comet Pro, you can also do this from the touchscreen.
• No port forwarding to the KVM’s web interface in the router settings.
• A separate network segment for the KVM. If your router supports VLANs and rules for traffic between segments, isolate the KVM from guest Wi-Fi, cameras, and other devices that do not need to reach it. Putting all of these devices on one network does not, by itself, restrict their access to one another.
• A Comet Pro screen lock password and physical access controls for the device and its cables.
• Checks for a used device. Confirm that the previous owner has unlinked it from their cloud account, update the firmware, and reset it before setting it up for yourself.

KVM and crypto wallets: what to avoid

Anyone with KVM access can see the computer’s screen and enter commands. If a wallet or an exchange session is open, they can also carry out operations that require no further confirmation.

Do not keep substantial funds in software wallets on a computer connected to a KVM. Someone who controls its keyboard and mouse can use an unlocked browser extension or an open exchange session. Keep only the funds needed for that system’s operation on the machine, and sign out of services you are not using.

A Lightning node operates as an online wallet: channel keys are stored on its hardware, so a system compromise can put channel funds at risk. If you use a KVM to maintain the node, limit the amount to what you need for its operation and protect the console as carefully as access to the wallet itself.

For an Ethereum validator, keep the validator’s signing keys separate from the keys for the wallet that receives withdrawals. Signing keys are needed on the server to run the validator, while the keys controlling the withdrawal address should be held in a separate hardware wallet. If the withdrawal address is already set correctly, the signing keys alone cannot redirect funds to an attacker’s address. However, an attacker could stop the validator or use its keys to sign conflicting messages and cause slashing—a penalty that removes part of the stake.

During normal hardware wallet use, private keys stay on the device, and transactions are confirmed with a physical button or a touch on its screen. A KVM cannot press a button on a Ledger or Trezor, but it can be used to prepare a transaction or change information in the computer’s wallet app. Check the transaction details on the wallet’s screen before confirming. Do not mount a Fingerbot over its button: that would allow remote confirmation without checking the transaction in person.

Comet’s Clipboard feature lets you paste text from the device you use to control the computer into the remote PC. If either device has clipboard-hijacking malware that replaces copied crypto addresses, a different address could end up in the recipient field. Before confirming, compare the address on the hardware wallet’s screen with the address obtained from a trusted source.

Alternatives to GL.iNet Comet

PiKVM is an established open-source project. You can build a device around a Raspberry Pi or buy one ready-made; two-factor authentication, detailed documentation, and community support are available. Cost and setup complexity depend on the version you choose and whether you assemble the kit yourself. Consider PiKVM if you want to choose the components and control the software.

JetKVM is a compact device with its own screen. The Eclypsium study mentioned above found two vulnerabilities in it, which the developers fixed in version 0.5.4. As with Comet, check the current firmware and available security controls before use.

Sipeed NanoKVM offers low-cost options. Before choosing a model, check its documentation, patch history, and the manufacturer’s response to security concerns. Assess concerns about DNS, SSH access, and the onboard microphone against the specific hardware revision and firmware version.

For Comet, the manufacturer provides cloud access, apps for major platforms, Tailscale integration, and power control accessories. This is convenient if you want a ready-made device with supported connection methods. GL.iNet’s security advisories identify the firmware versions that fix known vulnerabilities.

How to test emergency access

1. Connect from another network. Open the KVM from a phone using mobile data, sign in, and check the video, keyboard, and mouse. If you plan to use only Tailscale, repeat the test with GL.iNet Cloud disabled.
2. Test turning the computer on. Shut down the OS normally, then turn the computer on using the ATX board, Fingerbot, or Wake-on-LAN. Wait for the boot screen to appear.
3. Enter BIOS/UEFI. Press the required key in the remote console during startup, then check the display and keyboard response. Exit without changing any settings and wait for the OS to start.
4. Test virtual media. In Virtual Media → Image Mounting, mount the ISO image you need and check that the computer recognizes it as a drive. If you test booting from it, do so during a maintenance window and do not start an installation or format the disk.
5. Test backup internet and power. If you have an LTE connection and backup power, check whether KVM access remains available after switching to them. Ethernet and Wi-Fi on the same router do not provide backup internet if the connection to the provider has failed.

Conclusion

KVM over IP gives you screen and keyboard access when the system has not yet booted or ordinary remote access software no longer works. Comet PoE suits a wired network with PoE, while Comet Pro adds Wi-Fi and an HDMI output for a monitor. To recover a system without visiting the site, test power, internet connectivity, BIOS/UEFI access, and remote power-on in advance. Secure the KVM during the initial setup, especially if you maintain a node or server that holds keys and funds needed for its operation.