How to use and share a single mouse/keyboard across devices

Barrier is a free and open-source KVM forked from Synergy. It mimics the functionality of a KVM switch. It allows you to use and share a single mouse and keyboard across multiple devices. For instance, my macOS (server) and Ubuntu (client).

For Windows and MacOS (brew install barrier), the latest packages are available here. Ubuntu: sudo snap install barrier. Arch: pacman -S barrier.

Step 1. MacOS: Server (share this computer’s mouse and keyboard). Click on Configure Server…

Drag and drop the computer icon from the top right to a suitable position. The position is essential because that’s how your mouse pointer will move between screens. Observe that you should provide the hostname of the client computer.

My Barrier server configuration. Left to right: MyLinux (PC, Ubuntu), Maximos-Mac-… (my MacPro, macOS).

Step 2. Ubuntu: Client (use another computer’s mouse and keyboard). Disable Auto config. Screen name: MyLinux. Server IP: 192.168.1.40 (my MacOS’s IP).

Maybe you could set up Barrier to run on startup. Launch Startup Applications: Name (Barrier), Command (/usr/bin/barrier).

Step 3. Set Barrier to automatically launch at boot up (macOS). Go to System Preferences and click Users & Groups. Then, click on Login Items. At the bottom left corner of the window, click on the lock icon and enter your admin password. Click the plus (+) sign, Applications and select Barrier to auto-start.

Sharing a mouse and keyboard between Windows and nixOS.

Input-Leap is a direct fork of Barrier by Barrier's own active maintainers. It enables seamless mouse/keyboard sharing across machines. Add to your home.nix or home-manager.nix:

The Visual C++ v14 Redistributable is required by Input‑Leap in Windows.

# ── Input-Leap (replaces services.barrier, removed in 25.11) ─────────────────
# input-leap is a direct fork of barrier by barrier's own maintainers.
# home-manager 25.11 has no services.input-leap module yet, so we wire
# it up as a plain systemd user service.
{ config, pkgs, ... }:
{
  # 1. Install the package
  home.packages = [ pkgs.input-leap ];

  # 2. Systemd user service for Input Leap client
  systemd.user.services.input-leap-client = {
    Unit = {
      Description    = "Input Leap client (screen sharing — controlled screen)";
      After          = [ "graphical-session.target" ];
      PartOf         = [ "graphical-session.target" ];
    };

    Service = {
    # Replace with your server's hostname or IP (192.168.1.12) and port (default Input Leap port is 24800), and your screen name
      # --no-daemon: Run in foreground (required for systemd)
      # --disable-crypto: No TLS encryption (use only on trusted LAN, unsafe but easy)
      # --name: Screen name must match server's configuration, e.g., nixos
			ExecStart = "${pkgs.input-leap}/bin/input-leapc --no-daemon --disable-crypto --name nixos 192.168.1.12:24800";
			Restart    = "on-failure";
			RestartSec = "5s";

      # Ensure graceful shutdown
      KillMode = "process";
		};

		Install = {
				WantedBy = [ "graphical-session.target" ];
		};
  };
}

• Build and Switch: sudo nixos-rebuild switch --upgrade. Start the service: systemctl --user start input-leap-clien (manual) or let it auto-start with graphical session (enabled by default).

• Server (let’s say your laptop or PC with Windows): Server (share this computer’s mouse and keyboard), click on Configure Server and do as previously (in this case nixos on the left, myWindows on the right)

• Barrier, Change Settings: Start Barrier on startup, uncheck Enable SSL.

• Client (NixOS): Client (use another computer’s mouse and keyboard). Screen name (NixOS’s name, e.g., nixos), Server IP (self-explanatory).

• Enable port 24800 in Windows and Linux:

Windows PowerShell (as an administrator)
New-NetFirewallRule -DisplayName "Barrier" -Direction Inbound -LocalPort 24800 -Protocol TCP -Action Allow

Create a new firewall rule that allows inbound traffic on a specific port.

1. New-NetFirewallRule: It creates a new rule in the Windows Firewall.
2. DisplayName “Barrier”: Sets the name of the firewall rule to “Barrier,” making it easier to identify later.
3. Direction Inbound: Specifies that the rule applies to incoming traffic.
4. LocalPort 24800: Indicates that the rule applies to TCP traffic on port 24800, which is used by Barrier for communication.
5. Protocol TCP: Specifies that the rule applies to the TCP protocol.
6. Action Allow: Indicates that the rule will allow the specified traffic.

Help KVM clients

NixOS
vim /etc/nixos/configuration.nix
  networking.firewall = {
    allowedTCPPorts = [ ... 24800 ... ];
    allowedUDPPorts = [ ... 24800 ... ];
  };

vim ~/dotfiles/config (i3)
# They prevent i3's "helpful" behaviors that fight remote mouse control. Don't steal focus from new windows/popups
focus_follows_mouse no
mouse_warping none
focus_wrapping no

exec --no-startup-id i3-msg 'workspace $ws4; exec code --folder-uri vscode-remote://ssh-remote+myserver/mnt/data/justtothepoint'
# code --folder-uri "vscode-remote://ssh-remote+myserver/mnt/data/justtothepoint" is the documented way to open a remote folder via SSH.
# ssh-remote+myserver uses myserver from my ~/.ssh/config, which VS Code Remote‑SSH supports.

vim ~/dotfiles/alacritty.xml
# Some terminal emulators (like Alacritty, Kitty, or Xterm) have a feature that hides the mouse cursor as soon as you start typing to get it out of the way.
mouse = {
      hide_when_typing = true;  # ← HERE! Under [mouse]
    };

• Troubleshooting. Check Status: systemctl --user status input-leap-client and view logs: journalctl --user -u input-leap-client -f. Make sure that the computers are connected. A first step is to add a firewall rule to allow incoming ICMPv4 ping requests in our Windows Machine.

 netsh advfirewall firewall add rule name="
 Enable PING" protocol=icmpv4:8,any dir=in action=allow

1. netsh advfirewall firewall add rule add a new rule to the Windows Firewall.
2. name=“Enable PING”: Sets the name of the rule, making it identifiable.
3. protocol=icmpv4:8,any: Specifies the protocol to be ICMPv4, specifically type 8 (which is echo request, used for ping), and allows any code.
4. dir=in: Indicates that the rule applies to incoming traffic.
5. action=allow: Specifies that the rule will allow the specified traffic.

Ubuntu

  flatpak install flathub org.desktop.deskflow
  flatpak run org.desktop.deskflow

MacOS

Deskflow is the actively-maintained successor to Input Leap/Barrier/Synergy, and it’s explicitly network-compatible with them.

1. Install Deskflow via Homebrew. In Terminal, run the three commands above in order:
   (i) Tap the repo: brew tap deskflow/tap.
   (ii) Trust it (this cask needs that explicit step): brew trust deskflow/tap.
   (iii) Install: brew install deskflow.
   Once it finishes, open Deskflow from Applications or Spotlight so macOS registers it with the permission systems used in the next steps.

2. Grant Input Monitoring. System Settings, Privacy & Security, Input Monitoring. Find Deskflow in the list and toggle it on. This is what lets Deskflow capture your Mac’s keystrokes to send to the server, or receive them when you’re using another machine’s keyboard through this Mac. If Deskflow isn’t listed yet, launch it once first — macOS only adds an app to this list after it tries to use the capability.

3. Grant Accessibility. System Settings, Privacy & Security, Accessibility. Add and enable Deskflow here too — separate from Input Monitoring, this one covers mouse/cursor control and window-level interaction. Deskflow’s own docs call this out as required alongside Input Monitoring, not instead of it.
   Apple recently renamed the “Accessibility” privacy permission to “Device Control and Data Access” in recent macOS updates.

4. Grant Local Network access. System Settings, Privacy & Security, Local Network. Make sure Deskflow is toggled on. Without this, macOS silently blocks the LAN traffic Deskflow needs to find and talk to the server machine, even if the app itself looks like it’s running fine.

5. Configure Deskflow as a client. Open Deskflow, choose “Use another computer’s mouse and keyboard.” In Connect to, type the exact IP address of your server machine (e.g. the 192.168.1.12). Set this Mac’s screen name to match exactly what you configured for it in the server’s screen layout grid — a mismatch here is the most common reason a client shows as connected but control doesn’t pass to it.

6. Match TLS settings on both machines. On this Mac: Deskflow, Settings, Preferences, Network, and toggle Enable TLS Encryption off. Then, go do the identical toggle on the server machine’s Deskflow/Input Leap settings so both sides agree. TLS is on by default in Deskflow, and a client/server mismatch here (one encrypted, one not) will fail to connect rather than falling back automatically.
   Note the trade-off: with TLS off, keystrokes (including anything you type while “using” the server machine through this Mac) cross your LAN unencrypted — fine on a trusted home network, worth reconsidering if the network is shared or untrusted.