KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #typescript #codex #cli #claude-code #mcp #rust #deepseek-harness #ai-agent

vpn-over-ssh

★ 47 Open GitHub ↗

Poor mans VPN over SSH, script which can help to setup VPN based on OpenSSH version 4.3+, creates a ssh tunnel to connect two networks, require root, works with Linux.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# vpn-over-ssh
Poor mans VPN over SSH, script which can help to setup VPN based on **OpenSSH version 4.3+**, creates a ssh tunnel to **connect two networks, require root, works with Linux**.

# Prerequisites

## Server & Client
CentOS:  
`yum install tunctl`

Debian/Ubuntu:  
`sudo apt-get install uml-utilities`

`which ip iptables`  
The script also need the '**ip**' command (from the 'iproute' package) and '**iptables**' command (from the 'iptables' package), install them in both the local and remote computers.

## Server

`vim /etc/ssh/sshd_config`
>     PermitRootLogin yes  
>     PermitTunnel yes  
>     ClientAliveInterval 30  
>     ClientAliveCountMax 6

CentOS:  
`/etc/init.d/sshd restart`

Debian/Ubuntu:  
`sudo /etc/init.d/ssh restart`

## Client (not required)
`vim /etc/ssh/ssh_config`
>     ServerAliveInterval 30  
>     ServerAliveCountMax 6

# Usage
Edit **svpn.sh**, just run it on client.

>     SERVER_SSH_PORT="22"  
>     SERVER_SSH_IP="1.2.3.4"  
>     CLIENT_ETHERNET="eth0"  
>     SERVER_ETHERNET="eth0"  
>     CLIENT_TUNNEL="tun2"  
>     SERVER_TUNNEL="tun1"  
>     CLIENT_TUN_IP="10.0.0.2"  
>     SERVER_TUN_IP="10.0.0.1"  
>     CLIENT_NET="192.168.2.0/24"  
>     CLIENT_GATEWAY="192.168.2.1"  
>     SERVER_NET="192.168.1.0/24"  
>     SERVER_GATEWAY="192.168.1.1"

## Start VPN
`svpn.sh -start`

## Stop VPN
`svpn.sh -stop`

# Network topology

* Server: Machine A/Host A  
* Client: Machine B/Host B

## Network topology A (Default)
>                    Has internet     Has internet  
>     192.168.1.0/24 (netA)|gateA <-> gateB|192.168.2.0/24 (netB)  
>
>     +------------------+            OpenSSH 4.3            +-----------------+  
>     |   Machine A      | tun1 -- Tunnel Interface -- tun2  |    Machine B    |  
>     |  Has a tunnel    | <-------------------------------->|   Has a tunnel  |  
>     |  and ethernet    | 10.0.0.1                10.0.0.2  |   and ethernet  |  
>     +----------+-------+     point to point connection     +---------+-------+  
>                | eth0                                           eth0 |  
>                | 192.168.1.100                         192.168.2.100 |  
>                | port 22                                             |  
>                | forwarded                                           |  
>                | here                                                |  
>     +----------+----------+          +-~-~-~-~-~-~-~-+       +-------+-------+  
>     |     Network A       |          |               |       |   Network B   |  
>     |    192.168.1.0/24   | 1.2.3.4  |  The Internet |       | 192.168.2.0/24|  
>     |    Has internet     |<-------->|               |<----->|  Has internet |  
>     |    NAT gateway      | Routable |               |       |  NAT gateway  |  
>     +---------------------+ Address  +-~-~-~-~-~-~-~-+       +---------------+

## Network topology B
>            hostA hasn't internet     Has internet  
>     192.168.1.0/24  (netA)|gateA <-- hostB|1.2.3.4  
>
>     +------------------+            OpenSSH 4.3            +-----------------+  
>     |   Machine A      | tun1 -- Tunnel Interface -- tun2  |    Machine B    |  
>     |  Has a tunnel    | <-------------------------------->|   Has a tunnel  |  
>     |  and ethernet    | 10.0.0.1                10.0.0.2  |   and ethernet  |  
>     +----------+-------+     point to point connection     +---------+-------+  
>                | eth0                                           eth0 |  
>                | 192.168.1.100                               1.2.3.4 |  
>                | port 22                                Has internet |  
>                | forwarded                                           |  
>                | here                                                |  
>     +----------+----------+          +-~-~-~-~-~-~-~-+               |  
>     |     Network A       |          |               |               |  
>     |    192.168.1.0/24   | 4.3.2.1  |  The Internet |               |  
>     |  Hasn't internet    |<-------->|               |<--------------+  
>     |    NAT gateway      | Routable |               |  
>     +---------------------+ Address  +-~-~-~-~-~-~-~-+

Edit **svpn.sh**

>     36:    ip route replace default via ${SERVER_GATEWAY}  
>     37:    # ip route del ${CLIENT_NET} via ${SERVER_TUN_IP}  
>     47:    # ip route add ${CLIENT_NET} via ${SERVER_TUN_IP}  
>     48:    ip route replace default via ${SERVER_TUN_IP}  
>     77:    ip route replace default via ${SERVER_GATEWAY}  
>     78:    # ip route del ${CLIENT_NET} via ${SERVER_TUN_IP}

## Network topology C
>                    Has internet     Has internet  
>     192.168.2.0/24 (netB)|gateB --> hostA|1.2.3.4 --> GFW  
>     or  
>                   4.3.2.1|hostB --> hostA|1.2.3.4 --> GFW  
>
>     +------------------+            OpenSSH 4.3            +-----------------+  
>     |   Machine B      | tun2 -- Tunnel Interface -- tun1  |    Machine A    |  
>     |  Has a tunnel    | <-------------------------------->|   Has a tunnel  |  
>     |  and ethernet    | 10.0.0.2                10.0.0.1  |   and ethernet  |  
>     +----------+-------+     point to point connection     +---------+-------+  
>                |                                                     ^  
>                |                                                eth0 |  
>                |                                             1.2.3.4 |  
>                |                                        Has internet |  
>                |                                                     |  
>     +----------+----------+          +-~-~-~-~-~-~-~-+               |  
>     |     Network B       |          |               |               |  
>     |    192.168.2.0/24   | 4.3.2.1  |  The Internet |               |  
>     |    Has internet     |<-------->|               |---------------+  
>     |    NAT gateway      | Routable |               |  
>     +---------------------+ Address  +-~-~-~-~-~-~-~-+

Edit **svpn.sh**

>     62:    # ip route add ${SERVER_NET} via ${CLIENT_TUN_IP}  
>     63:    ip route replace default via ${CLIENT_TUN_IP}  
>     64:    # iptables -t nat -A POSTROUTING -s ${SERVER_TUN_IP}/32 -o ${CLIENT_ETHERNET} -j MASQUERADE  
>     65:    # iptables -A FORWARD -p tcp --syn -s ${SERVER_TUN_IP}/32 -j TCPMSS --set-mss 1356  
>     90:    ip route replace default via ${CLIENT_GATEWAY}  
>     91:    # ip route del ${SERVER_NET} via ${CLIENT_TUN_IP}  
>     93:    # iptables -t nat -D POSTROUTING -s ${SERVER_TUN_IP}/32 -o ${CLIENT_ETHERNET} -j MASQUERADE  
>     94:    # iptables -D FORWARD -p tcp --syn -s ${SERVER_TUN_IP}/32 -j TCPMSS --set-mss 1356

# Performance (ping test)
## Topology B
Installing VMware Workstation 11 on Machine A (Windows 7).
>                              +-~-~-~-+-~-~-~-+  
>                              | Gateway G     |  
>                              | 192.168.1.1   |  
>                              +-~-~-~-+-~-~-~-+  
>                                      |  
>             +------------------------+------------------------+  
>             |                        |                        |  
>     +-------+-------+        +-------+-------+        +-------+-------+  
>     | Machine A     |        | Machine B     |        | Machine C     |  
>     | 192.168.1.4   |        | 192.168.1.2   |        | 192.168.1.3   |  
>     +-------+-------+        +---------------+        +---------------+  
>             |  
>             +------------------------+------------------------+  
>             |                        |                        |  
>             |                +-~-~-~-+-~-~-~-+        +-~-~-~-+-~-~-~-+  
>             |                |      NAT      |        |   Host-only   |  
>             |                |   Gateway E   |        |   Gateway F   |  
>             |                |  192.168.72.1 |        |  192.168.19.1 |  
>             |                +-~-~-~-+-~-~-~-+        +-~-~-~-+-~-~-~-+  
>             | Bridge                 |                        |  
>     +-------+-------+        +-------+-------+        +-------+-------+  
>     | VM Machine D1 |        | VM Machine D2 |        | VM Machine D3 |  
>     | 192.168.1.5   |        | 192.168.72.2  |        | 192.168.19.2  |  
>     +---------------+        +---------------+        +---------------+

### Host-only
>     Machine B --> ssh --> Machine A --> port forwarded --> VM Machine D3  
>          ^                                                       ^  
>          |                 SSH Tunnel Interface                  |  
>     tun2 | 10.0.0.2      point to point connection      10.0.0.1 | tun1  
>          +-------------------------------------------------------+  
>
>                                                      rtt avg  
>     D3 -> D3         ping -c 50 192.168.19.2         0.074 ms  
>     D3 -> F          ping -c 50 192.168.19.1         0.414 ms  
>     D3 -> A          ping -c 50 192.168.1.4          3.636 ms  
>     D3 -> G          ping -c 50 192.168.1.1          2.514 ms  
>     D3 -> B          ping -c 50 192.168.1.2          2.488 ms  
>     D3 -> C          ping -c 50 192.168.1.3          2.522 ms  
>     B  -> D3         ping -c 50 192.168.19.2         1.938 ms  
>     B  -> F          ping -c 50 192.168.19.1         2.179 ms  
>     B  -> D3         ping -c 50 10.0.0.1             1.930 ms

### Bridge
>     D1 -> D1         ping -c 50 192.168.1.5          0.074 ms  
>     D1 -> A          ping -c 50 192.168.1.4          0.452 ms  
>     D1 -> G          ping -c 50 192.168.1.1          1.421 ms  
>     D1 -> B          ping -c 50 192.168.1.2          1.361 ms  
>     D1 -> C          ping -c 50 192.168.1.3          1.429 ms

### NAT
>     D2 -> D2         ping -c 50 192.168.72.2         0.074 ms  
>     D2 -> E          ping -c 50 192.168.72.1         0.411 ms  
>     D2 -> F          ping -c 50 192.168.19.1         1.127 ms  
>     D2 -> A          ping -c 50 192.168.1.4          1.155 ms  
>     D2 -> G          ping -c 50 192.168.1.1          1.996 ms  
>     D2 -> B          ping -c 50 192.168.1.2          1.997 ms  
>     D2 -> C          ping -c 50 192.168.1.3          1.931 ms

vpn-over-ssh

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README