# openssh's vpn (simple route problem)

## GNUtoo

i'd like to be able to use openssh's vpn because:

-it can be used by a wide variety of computers that have ssh and tun

-it has skey

-it opens only the ssh port...

-could be usefull because most of people have a ssh service

i tryed to follow the following howto from the openssh man:

 *Quote:*   

> SSH-BASED VIRTUAL PRIVATE NETWORKS
> 
>      ssh contains support for Virtual Private Network (VPN) tunnelling using
> 
>      the tun(4) network pseudo-device, allowing two networks to be joined se-
> ...

 

but the route command doesn't work:

```
route add 10.0.50.0/24 10.1.1.1

route: netmask 000000ff doesn't make sense with host route

```

```
# route add 10.0.50.0 10.1.1.1

SIOCADDRT: No such device
```

```
# route add 10.0.50.0 10.1.1.1 dev ra0

Usage: inet_route [-vF] del {-host|-net} Target[/prefix] [gw Gw] [metric M] [[dev] If]

       inet_route [-vF] add {-host|-net} Target[/prefix] [gw Gw] [metric M]

                              [netmask N] [mss Mss] [window W] [irtt I]

                              [mod] [dyn] [reinstate] [[dev] If]

       inet_route [-vF] add {-host|-net} Target[/prefix] [metric M] reject

       inet_route [-FC] flush      NOT supported

```

by the way is it possible to join a openssh vpn from windows ?

----------

## thpani

normally you have to use "gw" before the gateway ip

```
# route add 10.0.50.0/24 gw 10.1.1.1
```

----------

## truc

 *thpani wrote:*   

> normally you have to use "gw" before the gateway ip
> 
> ```
> # route add 10.0.50.0/24 gw 10.1.1.1
> ```
> ...

 

IIRC you also need to the -net option:

route add -net 10.0.50.0/24 gw 10.1.1.1

or something like that.

----------

## GNUtoo

if my 2 network from the inside are 192.168.1.0/24

is that correct?

from the client

```
route add  -net 192.168.1.0/24 10.1.1.2
```

from the server

```
route add  -net 192.168.1.0/24 10.1.1.1
```

----------

## truc

oh, if both of your network are on the same subnet, then routing is not the way to go, you have to make a bridge between them (see openvpn bridge mode for a little explanation), I know how to make a bridge between two local interfaces (with brctl) but Idon't know how to do it bettween two distant network without openvpn. 

Tell us if you find anything!

----------

## GNUtoo

and what about if i'm not under the same subnet?

(i don't know in advance if i will be on the same subnet)

here i'm just trying to do a ssh vpn between my neighbourg's wifi and mine but i'd like to be able to do it from anywhere

----------

## truc

well if you're not on the same subnet then, it playing with the routes should be enough,but.. 

I've never set up a ssh-based vpn, but this shouldn't different from others vpn

set up the tunnel with ssh, try to ping the tun/tap interface from both ends, when this works, add the routes, and try to ping an other computer on the distant subnet. if that doesn't work, use tcpdump (or ethereal) and look where pings stop.

Btw, in your first post, you quoted the manpage:

 *Quote:*   

> The sshd_config(5) configuration option PermitTunnel controls
> 
> whether the server supports this, and at what level (layer 2 or 3 traf-
> 
> fic). 

 this would mean you can also be on the same network, but in that case you'd need to bridge interfaces.

So, let's say you're not on the same subnet right now, (this should be a little bit easier, oh well, not really easier nor harder.. but we have to choose something.. :Smile:  )

----------

## GNUtoo

i'll go for tcpdump because i can't ping each other tap interfaces

----------

## truc

even if tap interfaces should also work in 'routed' mode, tun are usually the way to go in this mode.

You'll probably find easier to configure your interfaces with iproutes2 instead of ifconfig/route.

give us the output of

```
ip address list

and

ip route list
```

keep in mind that when you'll be able to ping the interfaces between the two 'ssh hosts', you'll have to enable routing between interfaces if you want to access other hosts on the distant network (echo 1 > /proc/sys/net/ipv4/ip_forward)

taht's all I can think of right now:)

----------

## GNUtoo

while in the same network i'm able to ping the other interface but when i'm at my neighbourg network i can't why?

here the result of a ping using tcpdump:

# tcpdump -i tun0

```
# tcpdump -i tun0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on tun0, link-type EN10MB (Ethernet), capture size 96 bytes

22:11:42.663194 de:6a:57:72:2e:af (oui Unknown) > Broadcast, ethertype Unknown (0x88a2), length 32:

        0x0000:  1000 ffff ff01 0000 0000 0000 0000 0000  ................

        0x0010:  0000                                     ..

22:12:42.666610 de:6a:57:72:2e:af (oui Unknown) > Broadcast, ethertype Unknown (0x88a2), length 32:

        0x0000:  1000 ffff ff01 0000 0000 0000 0000 0000  ................

        0x0010:  0000                                     ..

22:13:42.670033 de:6a:57:72:2e:af (oui Unknown) > Broadcast, ethertype Unknown (0x88a2), length 32:

        0x0000:  1000 ffff ff01 0000 0000 0000 0000 0000  ................

        0x0010:  0000                      

```

that's all i have for a long ping...

From 192.168.1.118 icmp_seq=153 Destination Host Unreachable

----------

## truc

I'm not sure to uderstand, what about a small picture with with let say host A and host B, and their different configuration/interfaces (ip a l, ip r l )  :Question: 

----------

## GNUtoo

 *truc wrote:*   

> I'm not sure to uderstand, what about a small picture with with let say host A and host B, and their different configuration/interfaces (ip a l, ip r l ) 

 

server:

internal ip:192,168,1,105

external ip:85.27.13.176

client

internal ip:192.168.1.118

external ip:81.243.229.25

----------

## truc

routes still missing, but can you just give the output of ip a l and ip r l for the client and the server, it would be far simpler to understand...

we just need one post with everything so we can try to help easily without seeking for every liitle piece of info on this thread..

----------

## GNUtoo

 *truc wrote:*   

> routes still missing, but can you just give the output of ip a l and ip r l for the client and the server, it would be far simpler to understand...
> 
> we just need one post with everything so we can try to help easily without seeking for every liitle piece of info on this thread..

 

i don't have the ip command...in wich package is it?

----------

## think4urs11

it is in sys-apps/iproute2

'old school' equivalents would be something like netstat -rn (ip r l) and ifconfig -a (ip a l)

----------

## GNUtoo

from the client:

```
# ip a l

1: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop

    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff

2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000

    link/ether 00:13:a9:a9:09:d4 brd ff:ff:ff:ff:ff:ff

    inet 168.0.0.2/24 brd 168.0.0.255 scope global eth0

3: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

    inet6 ::1/128 scope host

       valid_lft forever preferred_lft forever

4: shaper0: <> mtu 1500 qdisc noop qlen 10

    link/ether

5: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop

    link/ether aa:f3:3d:09:68:83 brd ff:ff:ff:ff:ff:ff

6: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000

    link/ieee1394 08:00:46:03:01:ee:13:1a brd ff:ff:ff:ff:ff:ff:ff:ff

7: teql0: <NOARP> mtu 1500 qdisc noop qlen 100

    link/void

8: tunl0: <NOARP> mtu 1480 qdisc noop

    link/ipip 0.0.0.0 brd 0.0.0.0

9: gre0: <NOARP> mtu 1476 qdisc noop

    link/gre 0.0.0.0 brd 0.0.0.0

10: sit0: <NOARP> mtu 1480 qdisc noop

    link/sit 0.0.0.0 brd 0.0.0.0

11: ip6tnl0: <NOARP> mtu 1460 qdisc noop

    link/tunnel6 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 brd 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

12: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast qlen 1000

    link/ether 00:16:6f:b9:02:a4 brd ff:ff:ff:ff:ff:ff

13: ra0: <BROADCAST,MULTICAST,NOTRAILERS,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000

    link/ether 00:14:85:11:ef:02 brd ff:ff:ff:ff:ff:ff

    inet 192.168.1.118/24 brd 192.168.1.255 scope global ra0

    inet6 fe80::214:85ff:fe11:ef02/64 scope link

       valid_lft forever preferred_lft forever

15: tun0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 500

    link/ether c6:8a:08:76:80:ff brd ff:ff:ff:ff:ff:ff

    inet 192.168.3.2/24 brd 192.168.3.255 scope global tun0

    inet6 fe80::c48a:8ff:fe76:80ff/64 scope link

       valid_lft forever preferred_lft forever

16: tun1: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop qlen 500

    link/[65534]

17: tun2: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop qlen 500

    link/[65534]

18: tun3: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop qlen 500

    link/[65534]
```

```
# ip r l

192.168.3.0/24 dev tun0  proto kernel  scope link  src 192.168.3.2

192.168.1.0/24 dev ra0  scope link

168.0.0.0/24 dev eth0  proto kernel  scope link  src 168.0.0.2

127.0.0.0/8 via 127.0.0.1 dev lo  scope link

default via 192.168.1.1 dev ra0

```

----------

## GNUtoo

from the server

```
# ip a l

1: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop

    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff

2: plip0: <POINTOPOINT,NOARP> mtu 1500 qdisc noop qlen 10

    link/ether fc:fc:fc:fc:fc:fc peer ff:ff:ff:ff:ff:ff

3: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000

    link/ether 00:15:e9:aa:d3:82 brd ff:ff:ff:ff:ff:ff

    inet 168.0.0.1/24 brd 168.0.0.255 scope global eth0

4: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000

    link/ether 00:0b:6a:b0:91:87 brd ff:ff:ff:ff:ff:ff

5: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

    inet6 ::1/128 scope host

       valid_lft forever preferred_lft forever

6: shaper0: <> mtu 1500 qdisc noop qlen 10

    link/ether

7: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop

    link/ether be:7a:ae:3a:b9:f7 brd ff:ff:ff:ff:ff:ff

8: teql0: <NOARP> mtu 1500 qdisc noop qlen 100

    link/void

9: tunl0: <NOARP> mtu 1480 qdisc noop

    link/ipip 0.0.0.0 brd 0.0.0.0

10: gre0: <NOARP> mtu 1476 qdisc noop

    link/gre 0.0.0.0 brd 0.0.0.0

11: sit0: <NOARP> mtu 1480 qdisc noop

    link/sit 0.0.0.0 brd 0.0.0.0

12: ip6tnl0: <NOARP> mtu 1460 qdisc noop

    link/tunnel6 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 brd 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

13: ra0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000

    link/ether 00:08:a1:a0:1b:b7 brd ff:ff:ff:ff:ff:ff

    inet 192.168.1.105/24 brd 192.168.1.255 scope global ra0

    inet6 fe80::208:a1ff:fea0:1bb7/64 scope link

       valid_lft forever preferred_lft forever

14: tap0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue

    link/ether e6:80:1f:a7:8c:1e brd ff:ff:ff:ff:ff:ff

    inet 192.168.0.1/24 brd 192.168.0.255 scope global tap0

    inet6 fe80::e480:1fff:fea7:8c1e/64 scope link

       valid_lft forever preferred_lft forever

16: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,10000> mtu 1500 qdisc pfifo_fast qlen 500

    link/[65534]

    inet 192.168.3.1/32 scope global tun0

17: tun1: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop qlen 500

    link/[65534]

18: tun2: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop qlen 500

    link/[65534]
```

```
# ip r l

192.168.1.0/24 dev ra0  proto kernel  scope link  src 192.168.1.105

192.168.0.0/24 dev tap0  proto kernel  scope link  src 192.168.0.1

168.0.0.0/24 dev eth0  proto kernel  scope link  src 168.0.0.1

127.0.0.0/8 via 127.0.0.1 dev lo  scope link

default via 192.168.1.1 dev ra0  metric 2013

```

----------

## truc

you're definitely not really helpfull... anyway, have fun

----------

## GNUtoo

 *truc wrote:*   

> you're definitely not really helpfull... anyway, have fun

 

i included the code...

what other thing should i unclude?

----------

