Easy VPNs?

Ralf-Philipp Weinmann weinmann at cdc.informatik.tu-darmstadt.de
Fri Oct 10 04:30:39 EDT 2003


Ian Grigg <iang at systemics.com> writes:

> I'm curious - my understanding of a VPN was that
> it set up a network that all applications could
> transparently communicate over.
> 
> Port forwarding appears not to be that, in
> practice each application has to be reconfigured
> to talk to the appropriate port, or, each port
> has to be forwarded.
> 
> Am I missing something here?  If there is an
> easy SSH based strategy for VPNs, what is it?
> 
> iang

Well it's not a VPN per se, and it's dependent on the SSH client
you're using but it may help you anyway: When using an OpenSSH [1]
client one can enable dynamic portforwarding (the -D switch or the
DynamicForward option in ssh_config) which gives you a SOCKS server on
the machine you ssh from.

Under un*xy operating systems supporting LD_PRELOAD or similar dynamic
linker options you can then use something like tsocks [2] to make all
dynamically linked (and non-suid) applications performing only
outbound TCP connections use your SOCKS server.  This is sort of a
hack but works pretty good for me.

Something I've done as well in the past is run Slirp[3] on a remote
machine and have an SSH tunnel between Slirp and the PPP daemon on my
local machine. This assumes you have sufficient privileges on the
client machine however. It allows you to do both outbound TCP and UDP
however I do not really advise this strategy because of [4].

Cheers,
Ralf

[1] OpenSSH
    http://www.openssh.org
[2] TSOCKS - A transparent SOCKS proxying library
    http://tsocks.sourceforge.net
[3] Slirp
    http://slirp.sourceforge.net
[4] Why TCP over TCP Is a Bad Idea
    http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

-- 
Ralf-P. Weinmann <weinmann at cdc.informatik.tu-darmstadt.de>

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com



More information about the cryptography mailing list