7 ms·

I mention this every time this comes up but it's info worth spreading... "sshuttle", make any server into a VPN without VPN server-side software, this takes the

by tomxor 7y ago

I mention this every time this comes up but it's info worth spreading... "sshuttle", make any server into a VPN without VPN server-side software, this takes the pain out of doing your own VPN, gives you far more obscurity, lots of flexibility and in my experience it also performs much better - which I believe is due to the TCP deconstruct-reconstruct vs traditional VPN which does TCP over TCP. The only disadvantage is it's only for TCP (no UDP or multicast). For routing all your internet it's as simple as this (on the client only, no server setup): sshuttle -r user@1.2.3.4 0/0 That's it... server requirements are met by almost anything, you don't need root access, but it does need python, which most distros have by default. Now you can use your own little obscure server, yes it's not invulnerable a VPS provider can still look at you if they wish, but it's far less of a target than a purpose built consumer VPN provider. It's also far more powerful for slicing up and mixing subnets or only routing specific targets ... for example unblock a specific site, but don't re-route other traffic: sshuttle -r user@1.2.3.4 sci-hub.tw [edit] Minor issue worth mentioning, not to disappoint people trying this out - it's currently necessary to use the -x option to exclude the server itself from being routed on Linux, I think this is due to a kernel bug? which is a little annoying, hoping this will go away eventually. This is not relevant to BSD or Mac, although on Mac you have other kernel bugs to worry about in XNUs network stack. sshuttle -r user@1.2.3.4 -x 1.2.3.4 0/0 [edit] As "icelancer" has pointed out bellow, please note that using your own server ties your activity to your identity more definitively if you are the only one using the server and you pay for the server in your name. Not being a purpose built consumer VPN makes it a less likely target through significant obscurity, however in the event it IS targeted, it's uniqueness will make it easier to associate activity with you via the VPS provider. > This also ties your identity to a provider definitively. That's fine, as long as you tell people that's what is happening. A good consumer VPN that isn't a garbage one offers plausible deniability.

chias 7y ago
Okay so this is shockingly impressive. For those of you who are thinking "eh, I like my `ssh -D8080 user@1.2.3.4` solution", sshuttle has the following two advantages: 1. no need to configure your SOCKS proxy in your applications 2. it works even when dynamic forwarding is disabled on the host you're connecting to
cyphar 7y ago
These days WireGuard is just as easy to set up, and has lots of benefits over sshuttle (it's UDP based, supports roaming a-la Mosh, has a much more solid cryptographic design, and so on).
- icelancer 7y ago
  From the WireGuard installation instructions: "Generate a private and public key pair for the WireGuard server:" "umask 077 wg genkey | tee privatekey | wg pubkey > publickey" "This will save both the private and public keys to your home directory; they can be viewed with cat privatekey and cat publickey respectively." "Create the file /etc/wireguard/wg0.conf and add the contents indicated below. You’ll need to enter your server’s private key in the PrivateKey field, and its IP addresses in the Address field." That's not within reach of your average computer user.
  - ekianjo 7y ago
    > That's not within reach of your average computer user. Same for sshutle.
    - tomxor 7y ago
      I don't think anyone is under the delusion that non-technical users are going to use sshuttle, but not everyone has the will to invest the time and effort doing server side configuration of a VPN client for their personal use. sshuttle makes it simple for anyone who is the least bit familiar with ssh and has some kind of server access or is happy to spin up a VPS quickly, nothing more is necessary.
      - cyphar 7y ago
        There are plenty of scripts online that make it incredibly trivial to set up WireGuard (here's mine[1]). This isn't like configuring OpenVPN -- it actually only takes a minute or two to set up. Given that WireGuard is headed for inclusion into Linux mainline soon, it probably would be a good idea for folks to take a few minutes to learn how to use a technology that is going to be part of core Linux. [1]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg-enroll https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...
chooseaname 7y ago
> make any server Any server you have a login to, right? So in some respects wouldn't a commercial VPN be simpler?
- tomxor 7y ago
  Yes you must have a login... but setting up a VPS is literally a button click these days, it's not going to be much more complicated. no need to even login to an interactive shell to configure anything (or at the most `adduser` if there are no default non roots), all you need is a user name and password, any of the generic VPS images will work no configuration beyond an ssh user. It's almost as simple, faster, and importantly, far more obscure... vs consumer VPNs which are almost honey pots. It's also more powerful, you can selectively route things through different servers simultaneously.
  - icelancer 7y ago
    This also ties your identity to a provider definitively. That's fine, as long as you tell people that's what is happening. A good consumer VPN that isn't a garbage one offers plausible deniability.
    - tomxor 7y ago
      Yes this is true, it really depends what you want from your VPN. For security and anti-cencorship this works, among many other useful things that you can't do with a normal VPN - but if you are evading authorities or something then you cannot be personally associated with the server. I suppose that negates my point about it's obscurity, since you only care about that if you are evading prying eyes of some sort. I've updated my original comment to include your point.
    - cyphar 7y ago
      If you want to have any hope of anonymity when accessing the internet, use Tor. Don't use a single-hop proxy. Even if you assume that the VPN provider is trustworthy and won't roll over when they're handed an NSL (a questionable assumption), intelligence agencies can just as easily break into all the servers (owned by a single party) and log the traffic themselves. Personally, I would be surprised if they haven't already done this for some providers -- why wouldn't they?
r00fus 7y ago
How does this work for walled-garden mobile devices (ie, iOS)? There's a reason VPN providers have exploded in popularity: mobile internet devices have been mainstream for 5-10 years and they are system-locked but you can install apps.
- sjy 7y ago
  It doesn't. Instead, you install WireGuard for iOS for free and take a photo of the QR code supplied by your sysadmin, which just encodes a simple text configuration file with an ed25519 key. Then your sysadmin can route all your iOS traffic however they want, whether you are connected to the public internet by cellular or wifi.
paulcarroty 7y ago
SSH is much slower than VPN, it can be an issue in some use cases.
- tomxor 7y ago
  Can you elaborate? i've found the opposite to be true, but then I am usually restricted by crappy ADSL bandwidth of 6mbit or less so i could be more sensitive to different aspects of "slow". Note that sshuttle deconstructs the TCP packets before sending them over SSH which already uses TCP, it also performs differently to `ssh -D` and manages the buffer to prevent blocking behaviour over bandwidth limited connections: --no-latency-control Sacrifice latency to improve bandwidth benchmarks. ssh uses re‐ ally big socket buffers, which can overload the connection if you start doing large file transfers, thus making all your other sessions inside the same tunnel go slowly. Normally, sshuttle tries to avoid this problem using a “fullness check” that allows only a certain amount of outstanding data to be buffered at a time. But on high-bandwidth links, this can leave a lot of your bandwidth underutilized. It also makes sshuttle seem slow in bandwidth benchmarks (benchmarks rarely test ping latency, which is what sshuttle is trying to control). This option disables the latency control feature, maximizing bandwidth usage. Use at your own risk.
  - paulcarroty 7y ago
    I've tried to transfer ~2GB file over SSH tunnel and VPN (on the same host), it was 3-4 times faster over VPN.
juskrey 7y ago
BTW how do you make sshuttle autoreconnect?
- tomxor 7y ago
  There is a --daemon option but do not know if it includes this behavior, maybe give it a go. I prefer to keep it in the foreground so I can kill it easily. If you are using ssh keys you can at least use a bash while loop without incurring any password prompts: while ! sshuttle -r user@1.2.3.4 0/0; do sleep; done _Hold_ ctrl-c to escape the loop

by tomxor 7y ago

chias 7y ago

Okay so this is shockingly impressive. For those of you who are thinking "eh, I like my `ssh -D8080 user@1.2.3.4` solution", sshuttle has the following two advantages: 1. no need to configure your SOCKS proxy in your applications 2. it works even when dynamic forwarding is disabled on the host you're connecting to

cyphar 7y ago

These days WireGuard is just as easy to set up, and has lots of benefits over sshuttle (it's UDP based, supports roaming a-la Mosh, has a much more solid cryptographic design, and so on).

icelancer 7y ago
From the WireGuard installation instructions: "Generate a private and public key pair for the WireGuard server:" "umask 077 wg genkey | tee privatekey | wg pubkey > publickey" "This will save both the private and public keys to your home directory; they can be viewed with cat privatekey and cat publickey respectively." "Create the file /etc/wireguard/wg0.conf and add the contents indicated below. You’ll need to enter your server’s private key in the PrivateKey field, and its IP addresses in the Address field." That's not within reach of your average computer user.
- ekianjo 7y ago
  > That's not within reach of your average computer user. Same for sshutle.
  - tomxor 7y ago
    I don't think anyone is under the delusion that non-technical users are going to use sshuttle, but not everyone has the will to invest the time and effort doing server side configuration of a VPN client for their personal use. sshuttle makes it simple for anyone who is the least bit familiar with ssh and has some kind of server access or is happy to spin up a VPS quickly, nothing more is necessary.
    - cyphar 7y ago
      There are plenty of scripts online that make it incredibly trivial to set up WireGuard (here's mine[1]). This isn't like configuring OpenVPN -- it actually only takes a minute or two to set up. Given that WireGuard is headed for inclusion into Linux mainline soon, it probably would be a good idea for folks to take a few minutes to learn how to use a technology that is going to be part of core Linux. [1]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg-enroll https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...

chooseaname 7y ago

> make any server Any server you have a login to, right? So in some respects wouldn't a commercial VPN be simpler?

tomxor 7y ago
Yes you must have a login... but setting up a VPS is literally a button click these days, it's not going to be much more complicated. no need to even login to an interactive shell to configure anything (or at the most `adduser` if there are no default non roots), all you need is a user name and password, any of the generic VPS images will work no configuration beyond an ssh user. It's almost as simple, faster, and importantly, far more obscure... vs consumer VPNs which are almost honey pots. It's also more powerful, you can selectively route things through different servers simultaneously.
- icelancer 7y ago
  This also ties your identity to a provider definitively. That's fine, as long as you tell people that's what is happening. A good consumer VPN that isn't a garbage one offers plausible deniability.
  - tomxor 7y ago
    Yes this is true, it really depends what you want from your VPN. For security and anti-cencorship this works, among many other useful things that you can't do with a normal VPN - but if you are evading authorities or something then you cannot be personally associated with the server. I suppose that negates my point about it's obscurity, since you only care about that if you are evading prying eyes of some sort. I've updated my original comment to include your point.
  - cyphar 7y ago
    If you want to have any hope of anonymity when accessing the internet, use Tor. Don't use a single-hop proxy. Even if you assume that the VPN provider is trustworthy and won't roll over when they're handed an NSL (a questionable assumption), intelligence agencies can just as easily break into all the servers (owned by a single party) and log the traffic themselves. Personally, I would be surprised if they haven't already done this for some providers -- why wouldn't they?

r00fus 7y ago

How does this work for walled-garden mobile devices (ie, iOS)? There's a reason VPN providers have exploded in popularity: mobile internet devices have been mainstream for 5-10 years and they are system-locked but you can install apps.

sjy 7y ago
It doesn't. Instead, you install WireGuard for iOS for free and take a photo of the QR code supplied by your sysadmin, which just encodes a simple text configuration file with an ed25519 key. Then your sysadmin can route all your iOS traffic however they want, whether you are connected to the public internet by cellular or wifi.

paulcarroty 7y ago

SSH is much slower than VPN, it can be an issue in some use cases.

tomxor 7y ago
Can you elaborate? i've found the opposite to be true, but then I am usually restricted by crappy ADSL bandwidth of 6mbit or less so i could be more sensitive to different aspects of "slow". Note that sshuttle deconstructs the TCP packets before sending them over SSH which already uses TCP, it also performs differently to `ssh -D` and manages the buffer to prevent blocking behaviour over bandwidth limited connections: --no-latency-control Sacrifice latency to improve bandwidth benchmarks. ssh uses re‐ ally big socket buffers, which can overload the connection if you start doing large file transfers, thus making all your other sessions inside the same tunnel go slowly. Normally, sshuttle tries to avoid this problem using a “fullness check” that allows only a certain amount of outstanding data to be buffered at a time. But on high-bandwidth links, this can leave a lot of your bandwidth underutilized. It also makes sshuttle seem slow in bandwidth benchmarks (benchmarks rarely test ping latency, which is what sshuttle is trying to control). This option disables the latency control feature, maximizing bandwidth usage. Use at your own risk.
- paulcarroty 7y ago
  I've tried to transfer ~2GB file over SSH tunnel and VPN (on the same host), it was 3-4 times faster over VPN.

juskrey 7y ago

BTW how do you make sshuttle autoreconnect?

tomxor 7y ago
There is a --daemon option but do not know if it includes this behavior, maybe give it a go. I prefer to keep it in the foreground so I can kill it easily. If you are using ssh keys you can at least use a bash while loop without incurring any password prompts: while ! sshuttle -r user@1.2.3.4 0/0; do sleep; done _Hold_ ctrl-c to escape the loop