20

What is the difference between a tunnel, a VPN tunnel and an SSH tunnel? According to Wikipedia, "tunneling" is:

Tunneling typically contrasts with a layered protocol model such as those of OSI or TCP/IP. The delivery protocol usually (but not always) operates at a higher level in the model than does the payload protocol, or at the same level.

But that doesn't really mean much to me. So is a tunnel like HTTP being used to carry a TCP payload?

I guess all this "tunnel terminology" would make sense with a few practical (real-life) examples.

4 Answers 4

11

A SSH tunnel (mostly used as a socks proxy) is only working for TCP packets, as a VPN (like OpenVPN or PPTP) will also be able to work with UDP packets.

Browsing the web is only TCP, however most games are using UDP aswell. Also, if using a VPN you don't need to configure each application to use the VPN (since your OS will do this) but a socks proxy (for a SSH tunnel) do require some configuration.

If your application doesn't support these protocols, something as ProxyCap can be used to force applications to use that socks proxy.

15

With vpn, your computer becomes part of another network. All traffic between your computer and the target network is encrypted. You have access to all computers on the target network directly from your computer.

With ssh, you just connect to another host, but you don't become part of the server's network.

An analogy. Consider there is a discussion but you are not present. There is a phone. You call the room where the discussion takes part. If the phone in the remote room is a speaker phone, then your voice can be heard by everybody and everybody can talk to you directly. This is the vpn since for all practical purposes, you are virtually present.

If the phone is not speaker-phone capable, then you can talk only to one person at a time who relays the messages. That's the ssh analogy.

2
  • Thanks @David - thats the difference between VPN and SSH, but what about this tunneling stuff?
    – pnongrata
    Jun 13, 2012 at 19:39
  • 2
    The SSH tunnel forwards TCP connections only. A VPN forwards IP packets or network frames.
    – superuser
    Jun 13, 2012 at 19:41
3

The SSH tunnel forwards TCP connections only. A VPN forwards IP packets or network frames. A IP packet forwarding VPN can link IP subnets (with all IP-based protocols), and a network frame forwarding (bridged) VPN can link so the participants seem to be in the same Ethernet.

Encrypted similarly, there is no essential difference in security between a VPN and SSH tunnel.

0

SSH Tunnel

SSH tunnel allows you to create the tunnel which is forwarding all connections to the port NNNN of host to the port 22 (SSH) of the remote host.

You can do it with something like Autossh (examples: https://www.everythingcli.org/ssh-tunnelling-for-fun-and-profit-autossh/)

In this case you will find a single port forwarding rule to the host. Your routing tables will not change and no additional interfaces will be added.

VPN Tunnel

To set up a VPN tunnel, the Layer 3 interface at each end that must have a logical tunnel interface for the firewall to connect to and establish a VPN tunnel. A tunnel interface is a logical (virtual) interface that is used to deliver traffic between two endpoints. What this means is that if you look into your system interfaces using ipconfig(Windows)/ifconfig(Mac, Linux), you would see the a new interface that establishes the connectivity.

In the VPN Tunnel case, the routing tables will have multiple routes for the companies LAN from your default gateway for each of the subnet in the company. There will be routes to your company networks from your default gateway.

You can find the routes setup with the VPN client by running the command netstat -nr. Run the command with and without VPN connection and you will see the different in routing tables.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .