Comment by beagle3 | Hacker News Reader

Comment by beagle3 | Hacker News Reader

Parent Full thread

The design is possibly the simplest for what it does (and it does that exceedingly well).

sshuttle is:

- a tcp multiplexer (multiple connections onto one stream)

- a router (uses firewall rules to make normal connections go through the multiplexer)

- a few kludgy tunneling operations, to make the combination above seem like a real VPN (discovery of remote subnets, tunneling of DNS requests, ....)

- a default setup that runs the multiplexed stream through an ssh connection, thereby giving all the security guarantees that ssh provides (integrity, confidentiality, mitm resistance)

- packaged in such a way that the remote side needs to have a minimal python>2.6 install, and a user capable of making tcp connections. Nothing more.

In my experience, it works way better than IPSEC tunnels and some commercial VPNs that I've used. With two caveats that I'm ok with with: a) only TCP, and b) all connections seem to come from your remote ssh server. No VPN solution that I'm aware of makes so few demands; do you know of one that doesn't require root at the remote server?

ssh -D (socks5 mode) doesn't require root, and can forward both udp and tcp traffic, doing what it appears that the client requires. socks5 is just a protocol that tells the server to connect to X on port Y using protocol Z, or to bind to X on port Y using protocol Z. Root is only required if you want to bind to privileged ports. A bonus with this is that it only requires a SSH server in default configuration.

SOCKS5 most common usage is to just use it as a proxy for HTTP traffic or similar, but it can make any connection. The trick lies in the "kludgy tunnelling operations" and the "router" (firewall rules).It's this magic that makes it better than the socks5 proxy solution, as it really does appear like a VPN. I wonder how much effort it would be to get rid of some of the "magic", though.

But I have to agree, that ANYTHING is better than a real VPN in complexity.

> ssh -D (socks5 mode) doesn't require root, and can forward both udp and tcp traffic

No, but it requires a SOCKS5 client, of which there aren't many among software I use.

> The trick lies in the "kludgy tunnelling operations" and the "router" (firewall rules)

The other important part of the magic is the packaging. While ssh+socks support is pretty common these days, it is not supported on e.g. dropbear (which is popular on routers).

sshuttle copies whatever it needs to the other side; as a result, there's never an issue of version compatibility (which socks use sidesteps by virtue of using an old, cemented protocol). I have, in fact, needed to modify sshuttle with new options and features for a project, and I was not bound in any way by the existing protocol - whatever changes I made were always supported by the other end of the connection because the connection starts by copying them to the remote.

> I wonder how much effort it would be to get rid of some of the "magic", though.

sshuttle is very well written; It is easy to tear it apart and rebuild it in other ways. But if you took the magic apart, you'd be left with a non-standard UDP-deficient SOCKS-alike system. Why would you want that?

If you tied the local FW magic to a socks5 client, you'd be able to skip part of the magic, assuming you don't desperately need mDNS. SOCKS5 does UDP too, IIRC. I like tearing things apart, and I like making clean muggler solutions, rather than relying on wizardry. :)

With that said, I might still end up using sshuttle as it is. It's a nice project. I just crave for tinkering around. :D

Reply on news.ycombinator.com