3 ms·
Why wouldn’t you just run ssh -D to the remote machine? The effect is the same and you don’t need wire guard or wire proxy.
by TedDoesntTalk 5y ago
Why wouldn’t you just run ssh -D to the remote machine? The effect is the same and you don’t need wire guard or wire proxy.
- hotpotamus 5y agoPresumably you'd use it on a machine that doesn't expose SSH. That said, I really like sshuttle for this use case when SSH is available.
- octeep 5y agoI made it because my friends and I use wireguard to have a private network, and they don't feel comfortable running a ssh server on their machines. It can also be used with a vpn provider like Mullvad without setting up a new nic or requiring special privs.
- ignoramous 5y agoI want to point out a caveat to others: Proxifier != VPN wireproxy's wg only forwards TCP and UDP. I am not sure how ICMP is handled. Other transports, though rarely used, won't be tunneled (and may leak, if not dropped).
- octeep 5y agoTo clarify, UDP is not currently supported, but I intend to support it in the future. Incoming ICMP should be completely dropped, and outgoing ICMP is not supported.
- chockchocschoir 5y agoMost importantly missing: DNS, which usually is handled over UDP (changing slowly now with DNS-over-HTTPS and some TCP resolvers). Without handling DNS requests via your proxy, you're still leaking information about yourself to the resolver you're using.
- TedDoesntTalk 5y agoSOCKS5 supports DNS queries. Not sure if this project implements it though.
- tptacek 5y agoOne simple reason is that the serverside might not want to expose a shell to its clients, and instead just provide network connectivity; you can configure something like that with SSH, but it's a pain, and WireGuard is approximately as simple to set up as SSH, which is the primary reason it's so popular.
- djbusby 5y agoAnd it's crypto is "very good" (so I've heard, not an expert) And it's fast/low overhead. And yea, surprisingly easy, "just works" I lurk their maillist, seems a nice group.
- tptacek 5y agoIt is very good, it is objectively better in a lot of ways than legacy DNS protocols. But it's popularity is, I think, mostly because of ease-of-use.
- Hello71 5y agoIs it a pain? As far as I know, all that's needed is to insert restrict,command="/sbin/nologin",port-forwarding before the user's key in authorized_keys. You can add more security by using a separate user, but individual Unix users for each client are not^W^Wshould not be necessary for security.
- deleted 5y ago[deleted]