Papa’s got a brand new bag. SSH 4.3 has the ability to use the tun/tap driver to establish true VPN connections between two hosts that you 0wnz0r (have root). What this means is that I can at work connect to my home network and bridge the two together such that either my work computer can browse and access my local network, or vice versa. SSH port forwarding has consistently been one of the most powerful features of this tool, allowing all kinds of creative bridging and routing. But its always been a hack and required a fairly deep understanding of networking and creative design. Now you can turn remote login into full network access.
Of all the guides I used this guide for ubuntu edgy was the most straightforward. The only thing missing in this guide is that it doesn’t assign netmasks to the tun0 interfaces and for some reason that meant mine defaulted to using 255.255.255.255 . The other thing to keep in mind is that SSH will create the tun0 interface, and if one already exists say created by openvpn or another SSH session then you will receive no errors but no communication either.
Basic process. Create a strong SSH key and add it to the authorized_keys file on the server. Set PermitTunnel yes in the sshd_config on the server. Connect using -w0:any. Run ifconfig tun0
In my tests at work I could latency was around 100ms (20ms ping between the two hosts) but responsiveness was extremely close to being directly at home. SSH was already a powerful tool, its now become a lot more powerful. Consider that there are many hosts deep inside networks, normally completely inaccessible or protected by many layers of outer networks, gateways, firewalls, IDS’s and the like. Now such hosts can form full private VPN’s with anyone else that can hit on port 22 and I’m not even sure if it can be detected outside of the host that such bridging is taking place. Both a blessing and a nightmare to someone like myself.
Leave a Reply