Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 6 down vote favorite

I recently "bought" a VPS that I want to use as a Proxy to be able to use some sites and stuff that I can't reach from germany.

Since I was yet too lazy to set up Squid and OpenVPN (which I currently think is needed) I use ssh-tunneling.

Now after a couple of weeks I asked myself if ssh-tunneling wasn't just fine, or - and that is my question - if there are any caveats/contras/drawbacks that I need to have in mind?

share|improve this question
1  
For what it's worth, OpenVPN is extremely easy to set up using a static key if you are going from Linux to Linux. It's a bit trickier if one of your machines is Windows, but doable. bit.ly/ujkD2 – transistor1 Mar 19 '12 at 14:01

3 Answers

up vote 7 down vote accepted

The performance problem arise when you are tunneling TCP over TCP because you have two layers doing adaptive corrections (slow start, congestion avoidance, fast restransmit see RFC2001).

Not bieng aware of one another they will experience great difficulties if you have loss on the outer connection.

This page describes the phenomenon in detail.

edit:

Rather than sticking with the TCP over TCP problem have a look at sshuttle which prevents it.
Have a look at the section named "Theory of Operation" for even more details about this situation.

share|improve this answer
Doesn't the inner layer know that it's talking to the loopback interface? – Random832 Mar 19 '12 at 13:56
About your question the problem is that TCP doesn't support disabling those "optimizations", even if it were somehow "aware of it's position" as an inner stream it can't do anything. The problem here is the outer adaptive behavior will disrupt the inner one, which will try to adapt by slowing retransmission for example although the outer TCP stream is already adapting for that. – Shadok Mar 19 '12 at 14:10
I was thinking about the case where it's a normal tunneled TCP connection, not "TCP over IP over PPP over TCP" - in that case there's not actually a second TCP protocol stack - ssh is just forwarding a byte stream. And I didn't mean "aware of its position as an inner stream", I meant how in this situation it would have a loopback interface (the local port ssh is listening on) as its destination. – Random832 Mar 19 '12 at 14:30
OP talked about "some sites", I assumed he was doing HTTP over SocksV5 through SSH, which means he's doing TCP over TCP (SSH itself is TCP and the HTTP inside the tunnel flows over another TCP streams, which is encapsulated in SSH). – Shadok Mar 19 '12 at 16:21
@Random832 look at my edit concerning sshuttle and its readme, you'll get more details than I can give :) – Shadok Mar 19 '12 at 16:29
up vote 2 down vote

One thing I can think of out of my mind is performance. But that really depends on what kind of stuff you are tunnelling.

share|improve this answer
What kind of performance? Bandwidth? I currently use it to access hulu and some youtube videos that are blocked. – noxoc Mar 19 '12 at 11:34
CPU overhead (encryption) and possibly latency, most likely. – XTL Mar 20 '12 at 10:19
up vote 0 down vote

Normally I've found that latency increases but throughput is fine (90%) of normal with SSH tunnelling. Be sure to set ServerAliveInterval to prevent disconnects, and wrap it in a script to keep restarting the tunnel on failure.

The main drawback is that it's a per-TCP port tunnel, unless you use SOCKS. SOCKS is fine but the latency seems to increase even more with it, and of course, not every client supports SOCKS.

You may need to run GatewayPorts on the client or SSH server to allow others to connect through your tunnel. On the server this requires root access to the sshd_config.

The main performance caveat (as others note) is that unreliable connections likely do not fare well with this approach, as TCP's algorithms don't react well under encapsulation.

That said, SSH seems to "do the right thing" most of the time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.