up vote 9 down vote favorite
5
share [g+] share [fb]

Whenever I'm using the internet from an insecure location (such as public wifi) I like to use an ssh tunnel (ssh -D port host) to ensure my traffic can't be sniffed. Unfortunately, there seem to be many applications which do not provide a way to specify a proxy (Flash is one major example).

It feels like there should be some way to use a tunnel for all network traffic from my computer, but I'm complete ignorant of how to do this. Any help would be greatly appreciated.

link|improve this question
100% accept rate
3  
Of course you can't tunnel literally ALL of your traffic through ssh, because that would mean tunneling ssh through itself, but we knew what you meant. :) – CarlF Oct 29 '09 at 4:09
1  
this is a good idea but you're only protected between your computer and your ssh endpoint. after that, your traffic is in the clear (unless otherwise protected, eg SSL). granted, it's much more likely to be over a wire, but still... you can't really trust wires you don't control. – quack quixote Oct 29 '09 at 5:51
2  
But when you're out on the wide Internet, you have some safety in being just one of billions of packets, right? When you connect to a public Wi-Fi, you are one of maybe 3 connections, you can be identified personally, etc. – endolith Nov 2 '09 at 16:14
feedback

5 Answers

up vote 4 down vote accepted

man ssh gives an example of exactly this. An ssh based vpn:

SSH-BASED VIRTUAL PRIVATE NETWORKS
     ssh contains support for Virtual Private Network (VPN) tunnelling using
     the tun(4) network pseudo-device, allowing two networks to be joined
     securely.  The sshd_config(5) configuration option PermitTunnel controls
     whether the server supports this, and at what level (layer 2 or 3 traf-
     fic).

     The following example would connect client network 10.0.50.0/24 with
     remote network 10.0.99.0/24, provided that the SSH server running on the
     gateway to the remote network, at 192.168.1.15, allows it:

       # ssh -f -w 0:1 192.168.1.15 true
       # ifconfig tun0 10.0.50.1 10.0.99.1 netmask 255.255.255.252

~~ snip ~~

     Since a SSH-based setup entails a fair amount of overhead, it may be more
     suited to temporary setups, such as for wireless VPNs.  More permanent
     VPNs are better provided by tools such as ipsecctl(8) and isakmpd(8).

Once you have that new interface up, you'd just have to make it the default route, which is a different question.

link|improve this answer
feedback
up vote 2 down vote

Look for the "Tunnel" option in ssh. This creates a tunnel device that you can assign an IP address to, and then you change the default route to use that tunnel.

link|improve this answer
feedback
up vote 0 down vote

Just wanted to clear up that (ssh -D port host) is not a 100% secure way for traffic not to be sniffed. Adding (ssh -D -c blowfish port host) would be a better choice because you are atleast adding encryption to your session. There are more options you could add but it is easy enough to just type "man ssh" in your terminal or Google for a complete listing.

The option I think that you are looking for is setting up a VPN (Virtual Private Network)

Have a look at this article to get an understanding of the diffrence between the two (SSH vs. VPN) or a good summarized version, before you tackle setting up your own VPN. If you do decide to go the VPN route I recommend OpenVPN, its free and lots of documentation and support.

link|improve this answer
5  
bad advice. "blowfish" is an SSH-1 cipher; it's fast, thought secure (as of 1999: unixhelp.ed.ac.uk/CGI/man-cgi?ssh+1 ), but still. you probably want ssh -2 -C -D [...] (force SSH2, use compression) and drop the -c. according to my system's man ssh the cipher list in SSH2 defaults to aes128-cbc,3des-cbc,blowfish-cbc,[etc]. my point is, if you request -c blowfish you might end up with SSH1, which is much less secure than SSH2. – quack quixote Oct 29 '09 at 5:58
1  
True, but the Jeremy was under the impression that the connection was secure with just -D 8080, I merely stated it was better than what he was using. You make a valid point and that is why I mention the manual for more options. – ricbax Oct 29 '09 at 6:26
Maybe you should change your answer, since it is helpful otherwise. – endolith Nov 2 '09 at 16:16
Forgot I asked this, don't use this site regularly. Thanks for the clarification... I had the strong impression that SSH was secure by default. – Jeremy Banks Dec 18 '10 at 4:10
2  
WTF ain't SSH using encryption by default ?? – LatinSuD Jul 18 '11 at 10:31
feedback
up vote 0 down vote

I've developed software that allows you to forward all TCP and optionally UDP through a SOCKS5 proxy, system-wide.

http://code.google.com/p/badvpn/wiki/tun2socks

It can even be installed on a router to forward all connections from computers on the LAN.

link|improve this answer
feedback
up vote -1 down vote

Use these examples:

  • Forward port 80 from a remote host to 8888 on your localhost

    ssh -fnN -L8888:localhost:80 user@server

    Use this to access services on a remote host that are only available there

  • Forward port 80 from yourlocalhost to 8888 on a remote host

    ssh -fnN -R8888:localhost:80 user@server

    Use this to allow ther users to access your services: webserver, or whatever.

Cheers! :)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.