Is it possible to use a reverse ssh tunnel to force all network connection on the remote host through the local host.
Essentially:
local -> ssh -> remote remote web request -> ssh tunnel -> local -> internet
I want the remote to make connections through the locals VPN without having to authenticate on the remote as well
Hopefully this makes sense
You can but it kind of sucks and you would only normally do it on a very temporary hacky basis. Otherwise use OpenVPN or Wireguard or whatever. If you want to do it with ssh, see the VPN instructions on the man page. But I mean it’s janky.
Sshutle? It essentially makes traffic go through ssh from anywhere to anywhere. If you ssh into your machine, use sshuttle towards your local machine, I think you should be good
Wireguard might be what you want. You connect to your remote machine ( assume it is at home). You can setup what traffic goes over wireguard (some or all). On your home machine you can run port forward command and masquerading command once connected on home machine so that you have full lan access too. It is described in the wireguard setup docs.
So in summary you have your device A and services running on B, you connect to a vpn service using A, and you want the services running on B to use the same vpn connection?
I encountered this problem with torrenting and private trackers.
I solved it the other way around, by having the remote connect to the vpn and routing traffic from my device through that remote.
- get a mullvad subscription because they do wireguard
- create wireguard-outbound container on server and connect to mullvad
- create wireguard-inbound container on server and attach it to the network stack of wireguard-outbound
- attach any other containers on the server you want using the vpn to the network stack of wireguard-outbound
- install wireguard on your various devices instead of connecting to mullvad directly just connect to your wireguard-inbound container
For bonus points you can create a squid (proxy service) container and attach that to wireguard-outbound, then create a firefox profile that connects to that proxy. That way your device isn’t routing all traffic through the vpn, only the traffic from that firefox profile.
I’ve had this set up for several years now and for the most part it works very well. Occasionally I have to restart the containers but for the most part it’s great.
I’m not sure if you can do it without authenticating on the remote. Have you seen sshuttle? Maybe you can run that on the remote to connect to the local machine. If the issue is that the remote “can’t see” the local machine to ssh into it then you could try something like reverse tunnel the ssh port to the remote, and then use sshuttle to connect to the local port that is forwarding traffic.
Wut. C’mon.
If I’m reading this right, you just need to learn about routing. SSH has nothing to do with this. This is basic networking at best.
IDK anything about “routing” but I don’t think it can solve this problem without additional services.
If my laptop is A and I want all outbound connections to go through server B then B needs to be running some kind of service whether it’s merely a NAT router or VPN or proxy.
In this case OP actually want’s B’s outbound connections to go through A but it’s the same problem.
Love that you put it in quotes as if to be sarcastic. Hilarious.
This is basically how the entire Internet works, but you know that from your post. Surely you also know that traffic gets “routed” from place A to B all the time without SSH as well.
So if you want to “route” a remote instance back to another place, you:
- Set routing rules on the intended origin
- Set default route on the remote client
- Set restricted firewall rules so both the origin and client are allowed to talk to each other
- Traffic is routed
Another alternative is using Tailscale and setting an exit node on your network, which is essentially the same thing.
But you already knew that, and that’s why you chimed in with your comment. Stupid me.
How fucking stupid must I look, huh?
Sure mate.
I’ve been playing around with networks for decades. I’ll happily admit that my understanding is rudimentary at best, but configuring routing rules with IP tables or whatever so your device will act as a NAT seems a few levels beyond “basic networking”.
that’s why you chimed in with your comment. Stupid me.
The honest to god reason I chimed in was because your response seemed derisive, and I thought I might be able to soften a bit by either showing my own ineptitude or challenging your solution.