heiko/ssh-vpn
Watch
1
0
Fork
You've already forked ssh-vpn
 0
Code Issues Pull requests Projects Releases Wiki Activity
Wrapper around SSH to establish a secure OSI layer 3 tunnel
9 commits 2 branches 0 tags 35 KiB
  • Shell 89.4%
  • Makefile 10.6%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Heiko Schlittermann (HS12-RIPE) 2a890ba707
 prevent too many restarts and failure caused by too many restarts
2022-08-28 22:21:52 +02:00
bin Describe installation, test it 2022-03-31 19:13:31 +02:00
examples prevent too many restarts and failure caused by too many restarts 2022-08-28 22:21:52 +02:00
Makefile Describe installation, test it 2022-03-31 19:13:31 +02:00
README.md More on setup 2022-03-31 21:53:04 +02:00

README.md

SSH-VPN

SSH is versatile. Using the -w option SSH can even establish secure connections between tun (OSI layer 3) or tap (OSI layer 2) devices.

This project helps setting up and maintaining a VPN tunnel based on a SSH connection.

Installation

  1. Setup SSH to connect to your VPN endpoint:
    1. Create a key pair.
    2. Place the public key in the endpoint's ~root/.ssh/authorized_keys.
    3. Enable PermitTunnel in the endpoint's SSH server config.
  2. Test the SSH connection manually (as root, because the SSH client needs to create a local tunX device: 
    ssh -w any <remote host>
    should connect and create a tunX device on the remote host.
  3. Install this SSH VPN scripts and Systemd unit files: 
    make install
  4. Copy examples/ssh-vpn@example.com as /etc/default/ssh-vpn@<name of your tunnel>.
  5. Edit /etc/default/ssh-vpn@<name of your tunnel>. I strongly recommend using IPv6 for LOCAL_IP and REMOTE_IP. This avoids clashes with existing IP addresses. A good starting point to get a more or less uniq IPv6 ULA address is this ULA address generator.
  6. Enable the Systemd Unit: 
    systemctl enable ssh-vpn@<name of your tunnel>
  7. Start ths tunnel: 
    systemctl start ssh-vpn@<name of your tunnel>

Technical background

The command ssh -w any remote.example.com establishes a SSH connection as usual, from your local machine to the remote host. While you may be familiar with SSH's port forwarding options (-L, -R), here SSH creates tun devices on both ends. Tun device behave like normal network device for OSI layer 3 (IP).