使用 sshuttle 构建一个穷人的虚拟专网
VPN
![](/data/attachment/album/201910/18/210615fx29ppjtycecfa99.jpg)


如今，企业网络经常使用“虚拟专用网络”[来保证员工通信安全](https://en.wikipedia.org/wiki/Virtual_private_network)。但是，使用的协议有时会降低性能。如果你可以使用 SSH 连接远程主机，那么你可以设置端口转发。但这可能会很痛苦，尤其是在你需要与该网络上的许多主机一起使用的情况下。试试 `sshuttle`，它可以通过 SSH 访问来设置快速简易的虚拟专网。请继续阅读以获取有关如何使用它的更多信息。


`sshuttle` 正是针对上述情况而设计的。远程端的唯一要求是主机必须有可用的 Python。这是因为 `sshuttle` 会构造并运行一些 Python 代码来帮助传输数据。


### 安装 sshuttle


`sshuttle` 被打包在官方仓库中，因此很容易安装。打开一个终端，并[使用 sudo](https://fedoramagazine.org/howto-use-sudo/) 来运行以下命令：



```
$ sudo dnf install sshuttle
```

安装后，你可以在手册页中找到相关信息：



```
$ man sshuttle
```

### 设置虚拟专网


最简单的情况就是将所有流量转发到远程网络。这不一定是一个疯狂的想法，尤其是如果你不在自己家里这样的受信任的本地网络中。将 `-r` 选项与 SSH 用户名和远程主机名一起使用：



```
$ sshuttle -r username@remotehost 0.0.0.0/0
```

但是，你可能希望将该虚拟专网限制为特定子网，而不是所有网络流量。（有关子网的完整讨论超出了本文的范围，但是你可以在[维基百科](https://en.wikipedia.org/wiki/Subnetwork)上阅读更多内容。）假设你的办公室内部使用了预留的 A 类子网 10.0.0.0 和预留的 B 类子网 172.16.0.0。上面的命令变为：



```
$ sshuttle -r username@remotehost 10.0.0.0/8 172.16.0.0/16
```

这非常适合通过 IP 地址访问远程网络的主机。但是，如果你的办公室是一个拥有大量主机的大型网络，该怎么办？名称可能更方便，甚至是必须的。不用担心，`sshuttle` 还可以使用 `–dns` 选项转发 DNS 查询：



```
$ sshuttle --dns -r username@remotehost 10.0.0.0/8 172.16.0.0/16
```

要使 `sshuttle` 以守护进程方式运行，请加上 `-D` 选项。它会以 syslog 兼容的日志格式发送到 systemd 日志中。


根据本地和远程系统的功能，可以将 `sshuttle` 用于基于 IPv6 的虚拟专网。如果需要，你还可以设置配置文件并将其与系统启动集成。如果你想阅读更多有关 `sshuttle` 及其工作方式的信息，请[查看官方文档](https://sshuttle.readthedocs.io/en/stable/index.html)。要查看代码，请[进入 GitHub 页面](https://github.com/sshuttle/sshuttle)。


*题图由 [Kurt Cotoaga](https://unsplash.com/@kydroon?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) 拍摄并发表在 [Unsplash](https://unsplash.com/s/photos/shuttle?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) 上。*




---


via: <https://fedoramagazine.org/use-sshuttle-to-build-a-poor-mans-vpn/>


作者：[Paul W. Frields](https://fedoramagazine.org/author/pfrields/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Nowadays, business networks often use a VPN (virtual private network) for [secure communications with workers](https://en.wikipedia.org/wiki/Virtual_private_network). However, the protocols used can sometimes make performance slow. If you can reach reach a host on the remote network with SSH, you could set up port forwarding. But this can be painful, especially if you need to work with many hosts on that network. Enter **sshuttle** — which lets you set up a quick and dirty VPN with just SSH access. Read on for more information on how to use it.

The sshuttle application was designed for exactly the kind of scenario described above. The only requirement on the remote side is that the host must have Python available. This is because sshuttle constructs and runs some Python source code to help transmit data.

## Installing sshuttle

The sshuttle application is packaged in the official repositories, so it’s easy to install. Open a terminal and use the following command [with sudo](https://fedoramagazine.org/howto-use-sudo/):

$ sudo dnf install sshuttle

Once installed, you may find the manual page interesting:

$ man sshuttle

## Setting up the VPN

The simplest case is just to forward all traffic to the remote network. This isn’t necessarily a crazy idea, especially if you’re not on a trusted local network like your own home. Use the *-r* switch with the SSH username and the remote host name:

$ sshuttle -rusername@remotehost0.0.0.0/0

However, you may want to restrict the VPN to specific subnets rather than all network traffic. (A complete discussion of subnets is outside the scope of this article, but you can read more [here on Wikipedia](https://en.wikipedia.org/wiki/Subnetwork).) Let’s say your office internally uses the reserved Class A subnet 10.0.0.0 and the reserved Class B subnet 172.16.0.0. The command above becomes:

$ sshuttle -rusername@remotehost10.0.0.0/8 172.16.0.0/16

This works great for working with hosts on the remote network by IP address. But what if your office is a large network with lots of hosts? Names are probably much more convenient — maybe even required. Never fear, sshuttle can also forward DNS queries to the office with the *–dns* switch:

$ sshuttle --dns -rusername@remotehost10.0.0.0/8 172.16.0.0/16

To run sshuttle like a daemon, add the *-D* switch. This also will send log information to the systemd journal via its syslog compatibility.

Depending on the capabilities of your system and the remote system, you can use sshuttle for an IPv6 based VPN. You can also set up configuration files and integrate it with your system startup if desired. If you want to read even more about sshuttle and how it works, [check out the official documentation](https://sshuttle.readthedocs.io/en/stable/index.html). For a look at the code, [head over to the GitHub page](https://github.com/sshuttle/sshuttle).

*Photo by **Kurt Cotoaga** on **Unsplash**.*

## dac.override

Could not get it to work on rawhide -> rawhide. OSerror: socket operation on non-socket or something, and also something about a deprecated python module. I was able to connect to my ISP’s shell server with it though (not sure if theyre happy about that) . With -vvv it tells you quite a bit about the network topo/connections on the server.

## Brian

Due to some latency mitigation sshuttle is also pretty slow. It unfortunately doesn’t seem to be able to balance between latency and throughput so you have to choose one or the other. If you want throughput there is a cmdline option to disable the latency control.

## Nick

Why not do port forwarding on regular SSH and use socks5 proxy?

## Paul W. Frields

@Nick, the docs on the sshuttle site describe cases in which that is less performant. Check them out.

## Vernon Van Steenkist

Didn’t find the word Socks in the sshutlle documentation. Please explain. Firefox, Thunderbird and others support an ssh created Socks5 proxy natively. Plus ssh created Socks5 procured work with any ssh server including Microsoft, Mac etc. without any additional software on the host.

## Steven Bakker

If I understand it correctly, this is more than a proxy. It can tunnel

allTCP traffic for particular hosts/ports over the VPN. This is different than a Socks5 proxy that only works from your browser, and has to be explicitly configured as such in your browser.As the manpage (https://sshuttle.readthedocs.io/en/stable/manpage.html#discussion) says:

“Unlike most VPNs, sshuttle forwards sessions, not packets. That is, it uses kernel transparent proxying (iptables REDIRECT rules on Linux) to capture outgoing TCP sessions, then creates entirely separate TCP sessions out to the original destination at the other end of the tunnel.”

## Vernon Van Steenkist

With proxychains, you only have to do one Socks 5 configuration. However, my main point is that ssh created Socks 5 proxies require no additional server side software and do not require root access and work with ssh servers on any platform. sshuttle is not an option if you do not have root access and Python on the server and want to re-direct TCP traffic.

Since sshuttle appears to require root access on both the client and server if you want to re-direct all traffic, including UDP, and additional software, why not just use openvpn instead? Openvpn can tunnel over an ssh created Socks 5 proxy and with a static key, has extremely fast connect times.

In addition, Python consumes a lot of CPU and memory resources whereas ssh proxies and openvpn can be efficiently run on routers with 32Mb of RAM and 8MB disk drives.

## Brian

SShuttle does NOT require root access on the remote (server as you put it)

## Mehdi

It is indeed a poor man’s VPN 🙂 Tried it on HomeBrew, keeps crashing.

## Brian

Because then every client needs to be socksified either directly or through a shim library which is just more work. Sshuttle is transparent to all clients.

## Stuart D Gathman

Addressing some of the previous comments:

I’m guessing the python code sent to the remote is not python3 compatible, and that is why it doesn’t work on rawhide.

socks is a fine product, but is not an alternative to sshuttle, which

transparentlyredirects all TCP sessions.The main limitation of sshuttle is that it only redirects TCP. Apps using UDP (e.g. VOIP) are out of luck. But for TCP, it is slick as a whistle.

When do I use sshuttle? When I find myself on one of those locked down WiFi setups that only let you “browse the web”. They do not let you connect on port 22, for instance. In preparation, you need to set up a server where you can login via SSH on port 443. The article should have mentioned this preparation. There is an HTTPS proxy that can distinguish between SSH and HTTPS, so you can use the same port for both.

Another possibility to escape is a web proxy allowing you to CONNECT to port 22 on a server where you have a login.

## Stuart D Gathman

Oh cool. Looks like sshuttle supports UDP since last I checked some years ago. This article got me to check the man page. Thanks!

## catafest

Use this rule:

$IPT -A INPUT -p tcp –dport 22 -m state –state NEW -s 0.0.0.0/0 -j ACCEPT

## Qoyyuum

Unfortunately, this doesn’t work on Windows 10 or on its Windows Subsystem for Linux. Something about modprobe access denied or access to its iptables via WSL. But no issue on my Fedora Workstation.

## 4e5ty

is possible using this together with iodine?

some iodine server need ip but cant use them in this same time.

meybe sshutle will be answer?

## Mariusz

Works great for me. This is something I always wanted to have instead of some home-made scripts with lots of “-L” parameters.