4 ms·

A little pet peeve, why do people always overlook the most ubiquitous VPN solution of them all? OpenSSH Can create a full spectrum VPN & supports a stronger a

A little pet peeve, why do people always overlook the most ubiquitous VPN solution of them all? OpenSSH Can create a full spectrum VPN & supports a stronger and a broader range of ciphers than virtually all competing software, is entirely open source, runs on every platform I can think of, the list goes on. Heck via pointopoint it can even mimic freelan and be peer to peer :)

pault 13y ago
It takes longer to read the man page than to spin up an AMI with openVPN. That's my only excuse. :)
rwg 13y ago
Because... • TCP-in-TCP (or ${ANY_RELIABLE_STREAM}-in-${ANY_RELIABLE_STREAM}) performs very poorly in the face of packet loss. • SSH itself becomes a bottleneck on networks with a large bandwidth-delay product because of statically sized buffers in the client and server. (Though there's been some work done in OpenSSH to mitigate that.) • "Real" VPN software generally has niceties like MSS mangling TCP connections inside the tunnel to help prevent fragmentation of the encapsulated packets due to VPN overhead. SSH is great when you need a quick and dirty tunnel (I use it in SOCKS mode a fair bit), but it's not something I'd want to use for long-lived tunnels that will see a lot of data.
gaadd33 13y ago
Its not trivial (afaik) to route all traffic over an OpenSSH connection on most platforms is it? I mean you can have it act as a SOCKS proxy without much trouble but there's no easy way to route DNS lookups over it is there?
- icebraining 13y ago
  There's sshuttle: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
- jebblue 13y ago
  Firefox can be made set to do its DNS lookups over SOCKS: http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-troubleshooting/ssh-socks-dns-leaks-in-mozilla-firefox http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-tr...
- Nanzikambe 13y ago
  It is trivial, I use this simple script to open an SSH tunnel to a remote host, assign me and the remote host private IP on tunnel interfaces (/dev/tun0), setup a pointopoint route between them, nuke my regular routing table & and fix it so my default route points down the newly created tunnel. http://pastebin.com/CxaH6z49 http://pastebin.com/CxaH6z49
  - gaadd33 13y ago
    I wouldn't really call that trivial compared to enabling a VPN connection in most operating systems (i.e. clicking on the vpn icon and saying enable). Also it appears to require root access on the remote machine which would make it difficult to securely let a few people use it. Definitely a useful script for a quick linux to linux tunnel.
dingaling 13y ago
SSH is quenched by many firewalls in corporate and hotel networks. Not just blocking port 22 but also dropping the packets based on protocol inspection. There are hacks to tunnel SSH over HTTPS ( really ) but at that point you've abandoned the simplicity of SSH and might as well go with OpenVPN.
- simgidacav 13y ago
  Oh yeah, Corkscrew! I used that many times! :)
huhtenberg 13y ago
It's not P2P unless at least one of the P's is directly accessible.

pault 13y ago

It takes longer to read the man page than to spin up an AMI with openVPN. That's my only excuse. :)

rwg 13y ago

Because... • TCP-in-TCP (or ${ANY_RELIABLE_STREAM}-in-${ANY_RELIABLE_STREAM}) performs very poorly in the face of packet loss. • SSH itself becomes a bottleneck on networks with a large bandwidth-delay product because of statically sized buffers in the client and server. (Though there's been some work done in OpenSSH to mitigate that.) • "Real" VPN software generally has niceties like MSS mangling TCP connections inside the tunnel to help prevent fragmentation of the encapsulated packets due to VPN overhead. SSH is great when you need a quick and dirty tunnel (I use it in SOCKS mode a fair bit), but it's not something I'd want to use for long-lived tunnels that will see a lot of data.

gaadd33 13y ago

Its not trivial (afaik) to route all traffic over an OpenSSH connection on most platforms is it? I mean you can have it act as a SOCKS proxy without much trouble but there's no easy way to route DNS lookups over it is there?

icebraining 13y ago
There's sshuttle: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
jebblue 13y ago
Firefox can be made set to do its DNS lookups over SOCKS: http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-troubleshooting/ssh-socks-dns-leaks-in-mozilla-firefox http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-tr...
Nanzikambe 13y ago
It is trivial, I use this simple script to open an SSH tunnel to a remote host, assign me and the remote host private IP on tunnel interfaces (/dev/tun0), setup a pointopoint route between them, nuke my regular routing table & and fix it so my default route points down the newly created tunnel. http://pastebin.com/CxaH6z49 http://pastebin.com/CxaH6z49
- gaadd33 13y ago
  I wouldn't really call that trivial compared to enabling a VPN connection in most operating systems (i.e. clicking on the vpn icon and saying enable). Also it appears to require root access on the remote machine which would make it difficult to securely let a few people use it. Definitely a useful script for a quick linux to linux tunnel.

dingaling 13y ago

SSH is quenched by many firewalls in corporate and hotel networks. Not just blocking port 22 but also dropping the packets based on protocol inspection. There are hacks to tunnel SSH over HTTPS ( really ) but at that point you've abandoned the simplicity of SSH and might as well go with OpenVPN.

simgidacav 13y ago
Oh yeah, Corkscrew! I used that many times! :)

huhtenberg 13y ago

It's not P2P unless at least one of the P's is directly accessible.