4 ms·

IPv6 was my primary motivation. The interesting thing here is that - once the tunnel is set up - we're really not running any extra software other than SSH (on

IPv6 was my primary motivation. The interesting thing here is that - once the tunnel is set up - we're really not running any extra software other than SSH (on the client or on the server). My script just finds unused tunnels and IPs, calls SSH and sets up networking. So it is as unlikely to crash your machine as OpenSSH is :-) However, I would guess that a grey screen of death bug is due to a kernel-space issue, i.e. the Tun/Tap drivers. They are not built into OS X, which seems a real shame (as they're used with every user-space VPN: OpenVPN, sshuttle etc). It is possible that sshuttle is doing something wrong causing the tun/tap drive to crash. I would guess that my script would crash as often as OpenVPN does, as I bet/hope ssh is as solid as OpenVPN. If OpenVPN crashes as often as sshuttle, then the problem is likely the tun/tap driver. I hope to be trying this on a Mac in the next few days... just need to buy one first!

gonzo 13y ago
As of Mac OS X 10.6 (xnu 1456.1.26), Darwin has native user tunnels. utun devices are sockets rather than character devices and are created through a special control socket. They behave the same as the Free/OpenBSD tunnels, in that they prepend the IP version as a 32-bit word. See: http://www.opensource.apple.com/source/xnu/xnu-2050.18.24/bsd/net/if_utun.c http://www.opensource.apple.com/source/xnu/xnu-2050.18.24/bs... Also: https://github.com/bbits/openvpn-utun https://github.com/bbits/openvpn-utun
- justinsb 13y ago
  Thank you so much for that (genuinely!). This is the reason I love HN: in this discussion we have someone that pointed out the probably-good-enough-for-the-99% SOCKS proxy (let them eat SOCKS!), and you've now pointed me to the "right" tun/tap device for Mac OS X, saving me from hours of fixing something that is obsolete. Now I really need to get a Mac and get this working there!
  - gonzo 13y ago
    Its just OS X now. Apple dropped the "Mac" part.
- davepeck 13y ago
  Glad you found our bbits/openvpn-utun repo. We're currently using it in Cloak for Mac. (https://getcloak.com/ https://getcloak.com/ -- bbits is our github organization and Cloak's parent company.) Previously we maintained (and used) the tuntaposx kext, but keeping it up to date was becoming a burden. At WWDC, some of Apple's fine kernel networking engineers shared the proper incantations with us; this patch is the result.

gonzo 13y ago

As of Mac OS X 10.6 (xnu 1456.1.26), Darwin has native user tunnels. utun devices are sockets rather than character devices and are created through a special control socket. They behave the same as the Free/OpenBSD tunnels, in that they prepend the IP version as a 32-bit word. See: http://www.opensource.apple.com/source/xnu/xnu-2050.18.24/bsd/net/if_utun.c http://www.opensource.apple.com/source/xnu/xnu-2050.18.24/bs... Also: https://github.com/bbits/openvpn-utun https://github.com/bbits/openvpn-utun

justinsb 13y ago
Thank you so much for that (genuinely!). This is the reason I love HN: in this discussion we have someone that pointed out the probably-good-enough-for-the-99% SOCKS proxy (let them eat SOCKS!), and you've now pointed me to the "right" tun/tap device for Mac OS X, saving me from hours of fixing something that is obsolete. Now I really need to get a Mac and get this working there!
- gonzo 13y ago
  Its just OS X now. Apple dropped the "Mac" part.
davepeck 13y ago
Glad you found our bbits/openvpn-utun repo. We're currently using it in Cloak for Mac. (https://getcloak.com/ https://getcloak.com/ -- bbits is our github organization and Cloak's parent company.) Previously we maintained (and used) the tuntaposx kext, but keeping it up to date was becoming a burden. At WWDC, some of Apple's fine kernel networking engineers shared the proper incantations with us; this patch is the result.