Fedora - Use sshuttle to build a poor man’s VPN

Use sshuttle to build a poor man’s VPN

<div><p>Nowadays, business networks often use a VPN (virtual private network) for <a href="https://en.wikipedia.org/wiki/Virtual_private_network">secure communications with workers</a>. However, the protocols used can sometimes make performance slow. If you can reach reach a host on the remote network with SSH, you could set up port forwarding. But this can be painful, especially if you need to work with many hosts on that network. Enter <strong>sshuttle</strong> — which lets you set up a quick and dirty VPN with just SSH access. Read on for more information on how to use it.</p>
<p> <span id="more-29465"></span> </p>
<p>The sshuttle application was designed for exactly the kind of scenario described above. The only requirement on the remote side is that the host must have Python available. This is because sshuttle constructs and runs some Python source code to help transmit data.</p>
<h2>Installing sshuttle</h2>
<p>The sshuttle application is packaged in the official repositories, so it’s easy to install. Open a terminal and use the following command <a href="https://fedoramagazine.org/howto-use-sudo/">with sudo</a>:</p>
<pre class="wp-block-preformatted">$ sudo dnf install sshuttle</pre>
<p>Once installed, you may find the manual page interesting:</p>
<pre class="wp-block-preformatted">$ man sshuttle</pre>
<h2>Setting up the VPN</h2>
<p>The simplest case is just to forward all traffic to the remote network. This isn’t necessarily a crazy idea, especially if you’re not on a trusted local network like your own home. Use the <em>-r</em> switch with the SSH username and the remote host name:</p>
<pre class="wp-block-preformatted">$ sshuttle -r <em>username@remotehost</em> 0.0.0.0/0</pre>
<p>However, you may want to restrict the VPN to specific subnets rather than all network traffic. (A complete discussion of subnets is outside the scope of this article, but you can read more <a href="https://en.wikipedia.org/wiki/Subnetwork">here on Wikipedia</a>.) Let’s say your office internally uses the reserved Class A subnet 10.0.0.0 and the reserved Class B subnet 172.16.0.0. The command above becomes:</p>
<pre class="wp-block-preformatted">$ sshuttle -r <em>username@remotehost</em> 10.0.0.0/8 172.16.0.0/16</pre>
<p>This works great for working with hosts on the remote network by IP address. But what if your office is a large network with lots of hosts? Names are probably much more convenient — maybe even required. Never fear, sshuttle can also forward DNS queries to the office with the <em>–dns</em> switch:</p>
<pre class="wp-block-preformatted">$ sshuttle --dns -r <em>username@remotehost</em> 10.0.0.0/8 172.16.0.0/16</pre>
<p>To run sshuttle like a daemon, add the <em>-D</em> switch. This also will send log information to the systemd journal via its syslog compatibility.</p>
<p>Depending on the capabilities of your system and the remote system, you can use sshuttle for an IPv6 based VPN. You can also set up configuration files and integrate it with your system startup if desired. If you want to read even more about sshuttle and how it works, <a href="https://sshuttle.readthedocs.io/en/stable/index.html">check out the official documentation</a>. For a look at the code, <a href="https://github.com/sshuttle/sshuttle">head over to the GitHub page</a>.</p>
<hr class="wp-block-separator" />
<p><em>Photo by&nbsp;</em><a href="https://unsplash.com/@kydroon?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText"><em>Kurt Cotoaga</em></a><em>&nbsp;on&nbsp;</em><a href="https://unsplash.com/s/photos/shuttle?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText"><em>Unsplash</em></a><em>.</em></p>
</div>


https://www.sickgaming.net/blog/2019/10/...-mans-vpn/