1
-
2
- WARNING:
3
- On MacOS 10.6 (at least up to 10.6.6), your network will
4
- stop responding about 10 minutes after the first time you
5
- start sshuttle, because of a MacOS kernel bug relating to
6
- arp and the net.inet.ip.scopedroute sysctl. To fix it,
7
- just switch your wireless off and on. Sshuttle makes the
8
- kernel setting it changes permanent, so this won't happen
9
- again, even after a reboot.
10
-
11
- Required Software
12
- =================
13
-
14
- - You need PyXAPI, available here:
15
- http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
16
- - Python 2.x, both locally and the remote system
17
-
18
-
19
- Additional Suggested Software
20
- -----------------------------
21
-
22
- - You may want to need autossh, available in various package management
23
- systems
24
-
25
-
26
1
sshuttle: where transparent proxy meets VPN meets ssh
27
2
=====================================================
28
3
@@ -45,63 +20,82 @@ common case:
45
20
46
21
- You hate openssh's port forwarding because it's randomly
47
22
slow and/or stupid.
48
-
23
+
49
24
- You can't use openssh's PermitTunnel feature because
50
25
it's disabled by default on openssh servers; plus it does
51
26
TCP-over-TCP, which has terrible performance (see below).
52
-
27
+
53
28
54
29
Prerequisites
55
30
-------------
56
31
57
32
- sudo, su, or logged in as root on your client machine.
58
33
(The server doesn't need admin access.)
59
-
34
+
60
35
- If you use Linux on your client machine:
61
36
iptables installed on the client, including at
62
37
least the iptables DNAT, REDIRECT, and ttl modules.
63
38
These are installed by default on most Linux distributions.
64
39
(The server doesn't need iptables and doesn't need to be
65
40
Linux.)
66
-
41
+
67
42
- If you use MacOS or BSD on your client machine:
68
43
Your kernel needs to be compiled with `IPFIREWALL_FORWARD `
69
44
(MacOS has this by default) and you need to have ipfw
70
45
available. (The server doesn't need to be MacOS or BSD.)
71
46
72
47
73
- Obtaining sshuttle
74
- ------------------
48
+ - Python 2.x, both locally and the remote system. Python 3.x is not yet supported.
49
+
50
+ *WARNING *:
51
+ On MacOS 10.6 (at least up to 10.6.6), your network will
52
+ stop responding about 10 minutes after the first time you
53
+ start sshuttle, because of a MacOS kernel bug relating to
54
+ arp and the net.inet.ip.scopedroute sysctl. To fix it,
55
+ just switch your wireless off and on. Sshuttle makes the
56
+ kernel setting it changes permanent, so this won't happen
57
+ again, even after a reboot.
58
+
75
59
76
- - First, go get PyXAPI from the link above
60
+ Additional Suggested Software
61
+ -----------------------------
62
+
63
+ - You may want to need autossh, available in various package management
64
+ systems
65
+
66
+ - For Linux only tproxy support, you need PyXAPI, available here:
67
+ http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
77
68
78
- - Clone: ` git clone https://github.com/sshuttle/sshuttle.git `
79
69
70
+ Obtaining sshuttle
71
+ ------------------
80
72
81
- Usage on (Ubuntu) Linux
82
- -----------------------
73
+ - Clone::
83
74
84
- - ` cd packaging; ./make_deb `
75
+ git clone https://github.com/sshuttle/sshuttle.git
76
+ ./setup.py install
85
77
86
- - ` sudo dpkg -i ./sshuttle-VERSION.deb `
78
+ - From PyPI::
87
79
88
- - Check out the files in ` /etc/sshuttle ` ; configure them so your tunnel works
80
+ pip install sshuttle
89
81
90
- - ` sudo service sshuttle start `
91
82
83
+ Usage
84
+ -----
92
85
93
- Usage on other Linuxes and OSes
94
- -------------------------------
86
+ - Forward all traffic::
95
87
96
- < tt >src/ sshuttle -r username@sshserver 0.0.0.0/0 -vv</ tt >
88
+ sshuttle -r username@sshserver 0.0.0.0/0 -vv
97
89
98
90
- There is a shortcut for 0.0.0.0/0 for those that value
99
- their wrists
100
- <tt >src/sshuttle -r username@sshserver 0/0 -vv</tt >
91
+ their wrists::
92
+
93
+ sshuttle -r username@sshserver 0/0 -vv
101
94
102
95
- If you would also like your DNS queries to be proxied
103
- through the DNS server of the server you are connect to:
104
- <tt >src/sshuttle --dns -vvr username@sshserver 0/0</tt >
96
+ through the DNS server of the server you are connect to::
97
+
98
+ sshuttle --dns -vvr username@sshserver 0/0
105
99
106
100
The above is probably what you want to use to prevent
107
101
local network attacks such as Firesheep and friends.
@@ -112,6 +106,7 @@ then the remote ssh password. Or you might have sudo and ssh set
112
106
up to not require passwords, in which case you won't be
113
107
prompted at all.)
114
108
109
+
115
110
Usage Notes
116
111
-----------
117
112
@@ -127,7 +122,7 @@ to the remote python interpreter.
127
122
This creates a transparent proxy server on your local machine for all IP
128
123
addresses that match 0.0.0.0/0. (You can use more specific IP addresses if
129
124
you want; use any number of IP addresses or subnets to change which
130
- addresses get proxied. Using 0.0.0.0/0 proxies < i > everything</ i > , which is
125
+ addresses get proxied. Using 0.0.0.0/0 proxies * everything * , which is
131
126
interesting if you don't trust the people on your local network.)
132
127
133
128
Any TCP session you initiate to one of the proxied IP addresses will be
@@ -139,6 +134,19 @@ Fun, right? A poor man's instant VPN, and you don't even have to have
139
134
admin access on the server.
140
135
141
136
137
+ Support
138
+ -------
139
+
140
+ Mailing list:
141
+
142
+ * Subscribe by sending a message to <
[email protected] >
143
+ * List archives are at: http://groups.google.com/group/sshuttle
144
+
145
+ Issue tracker and pull requests at github:
146
+
147
+ * https://github.com/sshuttle/sshuttle
148
+
149
+
142
150
Theory of Operation
143
151
-------------------
144
152
@@ -155,18 +163,17 @@ doesn't care about individual connections; ie. it's "stateless" with respect
155
163
to the traffic. sshuttle is the opposite of stateless; it tracks every
156
164
single connection.
157
165
158
- You could compare sshuttle to something like the old <a
159
- href="http://en.wikipedia.org/wiki/Slirp">Slirp </a > program, which was a
166
+ You could compare sshuttle to something like the old `Slirp <http://en.wikipedia.org/wiki/Slirp >`_ program, which was a
160
167
userspace TCP/IP implementation that did something similar. But it
161
168
operated on a packet-by-packet basis on the client side, reassembling the
162
169
packets on the server side. That worked okay back in the "real live serial
163
170
port" days, because serial ports had predictable latency and buffering.
164
171
165
172
But you can't safely just forward TCP packets over a TCP session (like ssh),
166
173
because TCP's performance depends fundamentally on packet loss; it
167
- < i > must</ i > experience packet loss in order to know when to slow down! At
174
+ * must * experience packet loss in order to know when to slow down! At
168
175
the same time, the outer TCP session (ssh, in this case) is a reliable
169
- transport, which means that what you forward through the tunnel < i > never</ i >
176
+ transport, which means that what you forward through the tunnel * never *
170
177
experiences packet loss. The ssh session itself experiences packet loss, of
171
178
course, but TCP fixes it up and ssh (and thus you) never know the
172
179
difference. But neither does your inner TCP session, and extremely screwy
@@ -181,8 +188,7 @@ safe.
181
188
Useless Trivia
182
189
--------------
183
190
184
- Back in 1998 (12 years ago! Yikes!), I released the first version of <a
185
- href="http://alumnit.ca/wiki/?TunnelVisionReadMe">Tunnel Vision</a >, a
191
+ Back in 1998 (12 years ago! Yikes!), I released the first version of `Tunnel Vision <http://alumnit.ca/wiki/?TunnelVisionReadMe >`_, a
186
192
semi-intelligent VPN client for Linux. Unfortunately, I made two big mistakes:
187
193
I implemented the key exchange myself (oops), and I ended up doing
188
194
TCP-over-TCP (double oops). The resulting program worked okay - and people
@@ -197,8 +203,7 @@ tool we called "Double Vision").
197
203
198
204
I was still in university at the time. A couple years after that, one of my
199
205
professors was working with some graduate students on the technology that
200
- would eventually become <a href =" http://www.slipstream.com/ " >Slipstream
201
- Internet Acceleration</a >. He asked me to do a contract for him to build an
206
+ would eventually become `Slipstream Internet Acceleration <http://www.slipstream.com/ >`_. He asked me to do a contract for him to build an
202
207
initial prototype of a transparent proxy server for mobile networks. The
203
208
idea was similar to sshuttle: if you reassemble and then disassemble the TCP
204
209
packets, you can reduce latency and improve performance vs. just forwarding
@@ -215,7 +220,3 @@ later. You're welcome.
215
220
216
221
--
217
222
Avery Pennarun <
[email protected] >
218
-
219
- Mailing list:
220
- Subscribe by sending a message to
< [email protected] >
221
- List archives are at: http://groups.google.com/group/sshuttle
0 commit comments