8 ms·

Take a loot at sshuttle [0] for the next level of this. Support other protocols transparently without messing with SOCKS support. [0] https://github.com/sshut

by smw 6y ago

Take a loot at sshuttle [0] for the next level of this. Support other protocols transparently without messing with SOCKS support. [0] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle

nicolaslem 6y ago
sshuttle is amazing. I worked for a company that used it as its main and only "VPN" for years.
hultner 6y ago
+1 on this I’ve used shuttle as the primary way to access one of my customers network for a year now, it haven’t gotten around to set up proper VPN access for external people yet. But it’s been working surprisingly well. I need to rerun the command a couple of times a bad day but other then that it’s behaved quite good as an ad-hoc VPN. You can also use a jump-host, I do this since I can only access ssh on one of the servers from the IP of one of my servers. The only thing I could wish for would be an auto reconnect feature, been thinking about wrapping it in a shell loop to handle it but it requires sudo so I’ve been putting it of, I don’t like having a long running script with sudo.
chx 6y ago
How is this different to https://github.com/darkk/redsocks/ https://github.com/darkk/redsocks/ ? I am just asking because I have been using redsocks for a very long time and I am always open to improve things.
- dn3500 6y ago
  Redsocks is a tcp proxy and is layered on socks. Sshuttle is an IP proxy and is layered on ssh. They solve similar problems. Generally speaking sshuttle should perform better and work with non-tcp applications, for example udp, especially if you have multiple applications using it at the same time.
jillesvangurp 6y ago
Yes, we used this for several years as a poor man's intranet as well as a vpn. Not great for windows users as I understand it but works great for linux and mac users. Easy to test if you have access to some ssh server.
corychu 6y ago
Hi smw, I've added a section that mentions the sshuttle to the original article. Thanks for your suggestion!!!
xyzzy_plugh 6y ago
While perhaps less portable (and a bit more proprietary) it's worth checking out the new project of Avery Pennarun, better known as apenwarr -- the creator of sshuttle -- which has made the rounds here, Tailscale [0]. I've switched all my devices to it and frankly, it's wonderful. Private VPN, tunnel, VLAN, auth, sharing, all-in-one. 0: https://tailscale.com https://tailscale.com
- linsomniac 6y ago
  Can I ask why you chose Tailscale over the alternatives? I've been looking at that spectrum of products and Tailscale does look nice. One thing I can't get over is that it's pricing is "per user". That makes sense our user-oriented VPNs (dev workstations, home machines, and phones), but doesn't feel like it's oriented towards server use. My end use case is probably 80% securing server connectivity across sites. Alternatives I've looked at include: ZeroTier, Slack Nebula, OpenVPN Cloud, and PriTunl. ATM, I'm using ZeroTier for my home use and quite happy with it. I had hopes of being able to deploy something for work as well, which is why I leaned towards ZeroTier. For home use, TailScale's pricing wasn't a concern.
  - 3np 6y ago
    I’m considering something like this as well and my two current contenders are Nebula and ZeroTier. Would you say there’s and specific reason you singled out ZeroTier and is there anything you miss?
    - linsomniac 6y ago
      Nebula looks great for server-to-server connections for things like administrative management/control or the like. The fact that it's fully free means we wouldn't have to deal with licensing, unfortunately I can find it hard to get approval for licensing and purchasing. I like ZeroTier because: It was dead simple to set up, the web management UI is good, the "public" networks seemed like they might be nice for CI/CD servers to connect into some infrastructure to deploy (though that didn't work out because CI/CD docker didn't have flags allowing ZeroTier to work, but I did just get SSH over userspace ZeroTier working). It's super easy to set up in all the environments I've looked at.
corychu 6y ago
I tied to use sshuttle on macOS client. But somehow the https://www.whatismyip.com/ https://www.whatismyip.com/ still shows my client IP instead of the ssh-server's IP. On the other hand, https://www.whatismyip.com.tw/tw/ https://www.whatismyip.com.tw/tw/ shows the ssh-server's IP correctly. I wonder if anyone knows the reason...

by smw 6y ago

nicolaslem 6y ago

sshuttle is amazing. I worked for a company that used it as its main and only "VPN" for years.

hultner 6y ago

+1 on this I’ve used shuttle as the primary way to access one of my customers network for a year now, it haven’t gotten around to set up proper VPN access for external people yet. But it’s been working surprisingly well. I need to rerun the command a couple of times a bad day but other then that it’s behaved quite good as an ad-hoc VPN. You can also use a jump-host, I do this since I can only access ssh on one of the servers from the IP of one of my servers. The only thing I could wish for would be an auto reconnect feature, been thinking about wrapping it in a shell loop to handle it but it requires sudo so I’ve been putting it of, I don’t like having a long running script with sudo.

chx 6y ago

How is this different to https://github.com/darkk/redsocks/ https://github.com/darkk/redsocks/ ? I am just asking because I have been using redsocks for a very long time and I am always open to improve things.

dn3500 6y ago
Redsocks is a tcp proxy and is layered on socks. Sshuttle is an IP proxy and is layered on ssh. They solve similar problems. Generally speaking sshuttle should perform better and work with non-tcp applications, for example udp, especially if you have multiple applications using it at the same time.

jillesvangurp 6y ago

Yes, we used this for several years as a poor man's intranet as well as a vpn. Not great for windows users as I understand it but works great for linux and mac users. Easy to test if you have access to some ssh server.

corychu 6y ago

Hi smw, I've added a section that mentions the sshuttle to the original article. Thanks for your suggestion!!!

xyzzy_plugh 6y ago

While perhaps less portable (and a bit more proprietary) it's worth checking out the new project of Avery Pennarun, better known as apenwarr -- the creator of sshuttle -- which has made the rounds here, Tailscale [0]. I've switched all my devices to it and frankly, it's wonderful. Private VPN, tunnel, VLAN, auth, sharing, all-in-one. 0: https://tailscale.com https://tailscale.com

linsomniac 6y ago
Can I ask why you chose Tailscale over the alternatives? I've been looking at that spectrum of products and Tailscale does look nice. One thing I can't get over is that it's pricing is "per user". That makes sense our user-oriented VPNs (dev workstations, home machines, and phones), but doesn't feel like it's oriented towards server use. My end use case is probably 80% securing server connectivity across sites. Alternatives I've looked at include: ZeroTier, Slack Nebula, OpenVPN Cloud, and PriTunl. ATM, I'm using ZeroTier for my home use and quite happy with it. I had hopes of being able to deploy something for work as well, which is why I leaned towards ZeroTier. For home use, TailScale's pricing wasn't a concern.
- 3np 6y ago
  I’m considering something like this as well and my two current contenders are Nebula and ZeroTier. Would you say there’s and specific reason you singled out ZeroTier and is there anything you miss?
  - linsomniac 6y ago
    Nebula looks great for server-to-server connections for things like administrative management/control or the like. The fact that it's fully free means we wouldn't have to deal with licensing, unfortunately I can find it hard to get approval for licensing and purchasing. I like ZeroTier because: It was dead simple to set up, the web management UI is good, the "public" networks seemed like they might be nice for CI/CD servers to connect into some infrastructure to deploy (though that didn't work out because CI/CD docker didn't have flags allowing ZeroTier to work, but I did just get SSH over userspace ZeroTier working). It's super easy to set up in all the environments I've looked at.

corychu 6y ago

I tied to use sshuttle on macOS client. But somehow the https://www.whatismyip.com/ https://www.whatismyip.com/ still shows my client IP instead of the ssh-server's IP. On the other hand, https://www.whatismyip.com.tw/tw/ https://www.whatismyip.com.tw/tw/ shows the ssh-server's IP correctly. I wonder if anyone knows the reason...