Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sshuttle - tunnel all your traffic through ssh

github.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Sshuttle - tunnel all your traffic through ssh

#61

Post by HerraBRE »

sandGorgon wrote: post #57

Can I receive postbacks using this ? Explanation - as usual, my company works on a shared LAN which goes through a single internet connection. To test some applications, we have to be able to receive postbacks (on our developer machines) through 3'rd party services. The best way we found was to have an OpenVPN server running somewhere. Each developer connects to the VPN server and receives a private IP-address. All p…

Have you looked at http://pagekite.net/ ?

It's a generic "expose my local HTTP server to the Internet" tool, designed to be really convenient and easy to set up (assuming you already have a local HTTP server). If I understand you correctly, it may be exactly what you are looking for.

It's FOSS so if you don't want to use the service (my startup!) you can roll your own. :-) But if you're looking for convenience, the service is probably hard to beat. Come chat on #pagekite on Freenode if you've got any questions!

Re: Sshuttle - tunnel all your traffic through ssh

#62

Post by mike-cardwell »

apenwarr wrote: post #51
mike-cardwell wrote: post #31

Earlier quoted context omitted.

I've heared the claim that TCP over TCP doesn't work well countless times. I've been using OpenVPN in tcp mode for at least 5 years on a daily basis and never noticed a problem. I've even done SIP over a TCP OpenVPN configuration without a noticeable problem. It makes sense to me that it should perform badly, and it probably does for uses cases with a lot of traffic, but for an average user on a laptop, a TCP based V…

What happens is you essentially get "infinite bufferbloat." When there's no packet loss, you end up absolutely filling the transmit buffers at the entry points to the tunnels. The result, as other people have mentioned, is extremely poor interactive performance when you're simultaneously transferring large files. TCP-over-TCP not "broken" in the sense that the sessions will randomly drop or your kernel will crash or…

Yeah. I understand why it is claimed to be bad. But in all my years of using it, I've never had a problem like that which you just described.

Re: Sshuttle - tunnel all your traffic through ssh

#63

Post by mbesto »

tomjen3 wrote: post #59
ch0wn wrote: post #29

I set up an OpenVPN server for this purpose. This solution is so much easier and elegant, it's not even funny.

I tried to setup an openVPN server, but after chasing a rabbit hole of instructions down the craziest URLs with obsolete or missing information I finally gave up. How did you get it to work?

I did this on Linode:

http://library.linode.com/networking/openvpn/

Super easy to do even if you are a linux noob.

Re: Sshuttle - tunnel all your traffic through ssh

#64

Post by ch0wn »

mbesto wrote: post #63
tomjen3 wrote: post #59

Earlier quoted context omitted.

I tried to setup an openVPN server, but after chasing a rabbit hole of instructions down the craziest URLs with obsolete or missing information I finally gave up. How did you get it to work?

I did this on Linode: http://library.linode.com/networking/openvpn/ Super easy to do even if you are a linux noob.

That's the same guide I used. Very comprehensive and easy to follow.

Re: Sshuttle - tunnel all your traffic through ssh

#65

Post by pmjordan »

burgerbrain wrote: post #22
jrockway wrote: post #20

Earlier quoted context omitted.

The setup cost is higher, true, but the performance is better. TCP-over-TCP does not work well.

"sshuttle assembles the TCP stream locally, multiplexes it statefully over an ssh session, and disassembles it back into packets at the other end. So it never ends up doing TCP-over-TCP. It's just data-over-TCP, which is safe." I haven't bothered to look at how this is actually implemented, so I can't comment on how it actually works.

As far as I know it sets up firewall rules (ipfw/iptables) to redirect certain outgoing TCP connections to a local socket, where they are picked up by the sshuttle service and multiplexed over the ssh connection. at the other end, the stream is demultiplexed into connections again. Definitely no individual packets.

Re: Sshuttle - tunnel all your traffic through ssh

#66

Post by pmjordan »

mariana wrote: post #53
tlrobinson wrote: post #35

NOT all your traffic. This only does TCP. Any DNS, UDP, and other non-TCP IP traffic won't go through the tunnel! I tried sshuttle awhile ago and abandoned it because of this. The only thing worse than no security is a false sense of security.

Would it be too hard to add non TCP traffic tunneling? This already supports DNS traffic through the tunnel but I wonder it is feasible to tunnel all kinds of traffic (UDP and ICMP mostly) through it?

The SSH connection is inherently a reliable stream, so you need to be careful - it should work if you drop UDP packets if the ssh stream's send buffer is full, but there might be severe performance traps down that route. Maybe an expert can elaborate. The other issue is you'd need to do manual NAT-like connection tracking to match up sources and destinations. I could imagine many UDP-based protocols not taking kindly to that sort of treatment.

By the way, (open-)ssh itself supports a tun/tap VPN mode (-w I believe) that creates actual network interfaces on the two endpoints, and thus can transport any IP traffic. It needs to be explicitly enabled on the server, and needs kernel tun/tap support, which is usually missing on VPSes that don't let you run your own kernel (modules).

Re: Sshuttle - tunnel all your traffic through ssh

#67

Post by Xurinos »

tlrobinson wrote: post #49
tianyicui wrote: post #48

Earlier quoted context omitted.

I just tried, it does have the ability to route DNS requests through the tunnel. Out of curiosity, is it theoretically possible to route other kinds of traffic over this, e.g. UDP, ICMP(ping)? Thanks.

Sure it's possible (see: http://en.wikipedia.org/wiki/IP_over_Avian_Carriers ). I don't know why they haven't done it yet.

You are referring to the lowest OSI layer. It is easy to propose laying out new line (or network of birds), but the costs are huge.

http://img.tfd.com/cde/OSI.GIF

Re: Sshuttle - tunnel all your traffic through ssh

#68

Post by sandGorgon »

HerraBRE wrote: post #61
sandGorgon wrote: post #57

Can I receive postbacks using this ? Explanation - as usual, my company works on a shared LAN which goes through a single internet connection. To test some applications, we have to be able to receive postbacks (on our developer machines) through 3'rd party services. The best way we found was to have an OpenVPN server running somewhere. Each developer connects to the VPN server and receives a private IP-address. All p…

Have you looked at http://pagekite.net/ ? It's a generic "expose my local HTTP server to the Internet" tool, designed to be really convenient and easy to set up (assuming you already have a local HTTP server). If I understand you correctly, it may be exactly what you are looking for. It's FOSS so if you don't want to use the service (my startup!) you can roll your own. :-) But if you're looking for convenience, the s…

looks awesome - thanks !

I suppose we will sign up sooner or later - 10 Euro isnt too expensive.

Re: Sshuttle - tunnel all your traffic through ssh

#69

Post by HerraBRE »

sandGorgon wrote: post #68
HerraBRE wrote: post #61

Earlier quoted context omitted.

Have you looked at http://pagekite.net/ ? It's a generic "expose my local HTTP server to the Internet" tool, designed to be really convenient and easy to set up (assuming you already have a local HTTP server). If I understand you correctly, it may be exactly what you are looking for. It's FOSS so if you don't want to use the service (my startup!) you can roll your own. :-) But if you're looking for convenience, the s…

looks awesome - thanks ! I suppose we will sign up sooner or later - 10 Euro isnt too expensive.

Cool! We're actually doing a pilot program right now to try and better understand the needs of web developers who use PageKite, so be in touch if you'd like to be part of that.

Re: Sshuttle - tunnel all your traffic through ssh

#70

Post by fs111 »

Xurinos wrote: post #67
tlrobinson wrote: post #49

Earlier quoted context omitted.

Sure it's possible (see: http://en.wikipedia.org/wiki/IP_over_Avian_Carriers ). I don't know why they haven't done it yet.

You are referring to the lowest OSI layer. It is easy to propose laying out new line (or network of birds), but the costs are huge. http://img.tfd.com/cde/OSI.GIF

OSI? Really? http://pablotron.org/files/7_layer_burrito.html
Post reply on HN