Hacker News Reader

Comment by klearvue | Hacker News Reader

+1 to this, it's like 'ssh -D' on steroids, very easy to set up and just an 'apt-get install sshuttle' away. Also allows easy DNS request forwarding.

Of course, OpenSSH itself provides VPN capability too without the need for sshuttle but it's harder to set up.

View on HN

I notice both you and drtse4 like the tool but only mention what it's advertised to do, and not anything specific about your experience using it over 'ssh -D'. How has using it changed how you would have used 'ssh -D' ?

I suppose the most practical purpose for sshuttle is for shell accounts on a box you don't own, if you need to do random transport-level stuff to remote hosts through an intermediary and you want to use a client on your local host. So basically NMap if your shell doesn't support it and you can't copy-and-run 3rd-party binaries. I'd be interested to see how well sshuttle performs under an intense NMap scan.

It's a matter of convenience for me, substituting both (partially) OpenVPN and 'ssh -D'. I use 7 browsers (incl. 4 Firefox profiles) and a number of terminal tools that I often want to be seen coming from a specific server IP address from my /24 block - saves time configuring all of them individually to use SOCKS proxy or setting up OpenVPN on individual servers.

What are the commands you use? I personally think 'ssh -D 8081 host1', 'ssh -D 8082 host2', 'ssh -D 8083 host3' and configuring each browser for each port might be simpler, but maybe it's the learning curve of a new command throwing me off.

sudo sshuttle 0/0 --dns -H -r user@server:port

What do the -H and the -l options do? I've read the docs, but I still don't understand what/when they would be used for.

Agreed, the thing i like the most is that it transparently forwards the traffic configuring iptables, no more SOCKS proxy configuration to update every time and no dns issues.

It also has a -x option that let you exclude local subnets from the forwarding, e.g. -x 192.168.0.0/24,

Reply on news.ycombinator.com