I normally just do my tunneling with ssh -D. Is there an advantage of using SSH VPN instead of SSH as a SOCKS proxy?
OTOH I saw the value of using PPTP or L2TP-based VPN. It is supported on most systems by default. I set up one for iPhone because you cannot do SSH tunneling on it. On non-*nix systems there is usually no SSH installed by default. I opened my PPTP/L2TP VPN for friends running Windows.
It's also slightly easier to connect to PPTP/L2TP VPN with a single click on the menubar of OS X without installing any additional software.
Otherwise I stick with SSH tunneling with SOCKS proxy.
Could someone explain the benefits of SSH VPN please?
Also, since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have a firewall).
If you want complete privacy where ALL of your IP traffic is tunneled out, OpenVPN (or other tunneling layer 3 solution) is the way to go.
“since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have a firewall).”
I believe on OS X the SOCKS proxy is applied globally, unlike Windows where you have to do per-application settings. So aside from DNS queries, I guess other TCP connections should go through SOCKS? That should cover the major problem of FireSheep.
Also, since on Windows/OS X/iOS there is no default OpenVPN clients, I use PPTP/L2TP/IPSec-based VPN instead because they are available by default. Is there any advantage of OpenVPN over them?
OpenVPN in the configuration of the blog post utilizes 443/tcp, which is open at most places, while the ports required for PPTP/L2TP/IPSec could be closed.
If you don't have a static ip at home, OpenVPN with this configuration will mean loss of privacy to everyone on the internet.
I'm running a low-tech setup like this with sshd on my home router and PuTTY on my laptop, acting as a SOCKS proxy, and there are several applications that don't know how to talk to a SOCKS proxy. Luckily FF knows how to.
It doesn't. It merely installs a virtual network adapter and then you get creative with the routing table to pass the traffic you want through that adapter.
ssh vpn: tunnels all packets at the "network" level. bad because running TCP over TCP can have erratic performance. good because it covers all traffic.
openvpn: tunnels using UDP, so you don't have the TCP on TCP problems. it's just more work to set up than ssh vpn, but still probably easier than full blown ipsec.