Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sshuttle - tunnel all your traffic through ssh

github.com

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Sshuttle - tunnel all your traffic through ssh

#31

Post by mike-cardwell »

jrockway wrote: post #20
mike-cardwell wrote: post #18

Earlier quoted context omitted.

To use OpenVPN you have to install extra software on the server and edit configuration files and set up keys. Not sure how that is easier?

The setup cost is higher, true, but the performance is better. TCP-over-TCP does not work well.

I've heared the claim that TCP over TCP doesn't work well countless times. I've been using OpenVPN in tcp mode for at least 5 years on a daily basis and never noticed a problem. I've even done SIP over a TCP OpenVPN configuration without a noticeable problem.

It makes sense to me that it should perform badly, and it probably does for uses cases with a lot of traffic, but for an average user on a laptop, a TCP based VPN is fine.

Re: Sshuttle - tunnel all your traffic through ssh

#32

Post by agj »

The alternative that predates this is to this is to just tunnel ppp over ssh using pppd:

    pppd updetach noauth pty "ssh root@example.com pppd nodetach notty noauth" ipparam 192.168.1.100:192.168.1.2
I used this for many years before switching to openvpn. This does require root access on the host to execute pppd however.

Re: Sshuttle - tunnel all your traffic through ssh

#33

Post by jerf »

afhof wrote: post #30

http://bodhizazen.net/Tutorials/VPN-Over-SSH/

Please actually read the linked articles before replying, and signal some recognition of the fact you have done so in your reply. If you wish to argue that the arguments put forth in the sshuttle README are somehow invalid and that what you linked is still better, please do so, but at the moment it looks like you haven't even read them.

Re: Sshuttle - tunnel all your traffic through ssh

#34

Post by jerf »

mike-cardwell wrote: post #31
jrockway wrote: post #20

Earlier quoted context omitted.

The setup cost is higher, true, but the performance is better. TCP-over-TCP does not work well.

I've heared the claim that TCP over TCP doesn't work well countless times. I've been using OpenVPN in tcp mode for at least 5 years on a daily basis and never noticed a problem. I've even done SIP over a TCP OpenVPN configuration without a noticeable problem. It makes sense to me that it should perform badly, and it probably does for uses cases with a lot of traffic, but for an average user on a laptop, a TCP based V…

In my experience it depends heavily on what you are doing. When I'm just sending files from one place to another through my SSH VPN, it performs reasonably well. When you actually try to do something interactive, as in, interactive over the network, like a VNC or X connection or even just get intensive enough with a remote vi session, performance can and does randomly tank. sshuttle works far better for that use case. (I stopped using it because it didn't do DNS and I didn't have the time to add that but the commit log implies that has been fixed.)

Re: Sshuttle - tunnel all your traffic through ssh

#37

Post by brianjesse »

hollerith wrote: post #21
bryanlarsen wrote: post #7

+1 for a reference to slirp, which let you turn a dial-in connection to a Unix terminal into a real internet connection back in the days when your University would give you a terminal connection but not a PPP connection.

I remember SLIRP -- and The Internet Adapter.

I used SlipKnot for that -- it converted a shell-dialup at University of Oregon into a SLIP connection that I could use with Netscape 1.0

Re: Sshuttle - tunnel all your traffic through ssh

#38

Post by fs111 »

tlrobinson wrote: post #35

NOT all your traffic. This only does TCP. Any DNS, UDP, and other non-TCP IP traffic won't go through the tunnel! I tried sshuttle awhile ago and abandoned it because of this. The only thing worse than no security is a false sense of security.

I personally don't use it for security reasons, but to be able to listen to last.fm easily through a vps in a country, where that is for free. (just one example)

Security is never just a software you install, it also depends on you, knowing, what you do.

Re: Sshuttle - tunnel all your traffic through ssh

#39

Post by jerf »

tlrobinson wrote: post #35

NOT all your traffic. This only does TCP. Any DNS, UDP, and other non-TCP IP traffic won't go through the tunnel! I tried sshuttle awhile ago and abandoned it because of this. The only thing worse than no security is a false sense of security.

The commit log seems to imply DNS has been added: https://github.com/apenwarr/sshuttle/commit/0bf0351d9becae3d... (along with a few subsequent patches)

But I have not tried it.

Post reply on HN