Arch Linux

mhicklen

Member

Registered: 2017-07-13

Posts: 1

Using sshuttle or openssh to route the entire OS through tunnel

Hello all,

I am looking for a way to route my entire OS through an SSH tunnel or an sshuttle connection, but I want to be able to exclude a CIDR ranges - specifically, a few RFC1918 ranges as well as a few /24's on the public Internet.

I have this halfway working using sshuttle as follows:

    ip route add local default dev lo table 100
    ip rule add fwmark 1 lookup 100
    ip -6 route add local default dev lo table 100
    ip -6 rule add fwmark 1 lookup 100
    sshuttle --dns --method=tproxy -r username@remoteserver -X ~/.cidr-exclusions 0.0.0.0/0 ::/0

This allows for DNS requests to pass through the tunnel; however, the "remoteserver" has firewall rules in place to block outbound traffic aimed at various arbitrary ports and I'm looking to effectively "tunnel a second time through" to a 'more-remote-remoteserver', ie. daisy-chain my tunnel, so that my egress leaves a server over which I have full firewalling control.

The openssh tunnelling doesn't work so swell with my setup since I have to pass through an SSH agent and I have filtering set up in such a way to where I have to use a Netcat ProxyCommand as follows:

Host *
ProxyCommand ssh -C -p 22 remoteserver nc %h %p 2> /dev/null

As an aside, see the above where I use netcat (nc)?  Is there an encrypted means with which I can do that? E.g. a SOCKS5 proxy or something?  I'm having a hard time wrapping my head around it.

I am also thinking about using OpenVPN or similar to fully get around this, but the curiosity in me wants to figure this out in a less elegant way.