Network Diagram

In the Network Diagram above my aim is to ping from System A. I do not want to configure the router.

For that to happen

  1. All the traffic to should be first forwarded to

  2. Then System B should have a route to

Is there any way to add a route in System A such that to reach network the default gateway is Even if such route is added, in order to reach we still need the default gateway

Please suggest how can it be achieved?

2 Answers 2


The first thing that comes to mind is VPN over SSH. See man sshd_config and search for PermitTunnel.

First, make sure that PermitTunnel (both hosts) is enabled and that PermitRootLogin ( on systemB) is yes or without-password in /etc/ssh/sshd_config and that sshd is reloaded.

Next, login to the host using:

# ssh -NTCf -w 0:0

The following step is to configure the interfaces with a dedicated VPN subnet ( in this example):

systemA # ip link set tun0 up
systemA # ip addr add peer dev tun0

systemB # ip link set tun0 up
systemB # ip addr add peer dev tun0

Then add a route for the network behind System B:

systemA # ip route add via
systemA # ping

Another approach is to use sshuttle. Install sshuttle from source or the package manager. Then run:

systemA # /usr/sbin/sshuttle -D --pidfile /tmp/sshuttle.pid --dns -r user@systemB

This will ask for sudo password since iptables is used to route traffic. You can alter the /etc/sudoers file using visudo to avoid asking for a password:

 systemA # visudo
 # add:
 myuser ALL=(ALL) NOPASSWD: /sbin/iptables, /usr/bin/python

Some interesting references:


I followed your steps for VPN over SSH. But problem came with arp resolution.

After adding a route for

System C : route add -net p255p2

I issued following command for arp resolution

System B : sudo arp -sD eth1 pub

Ping worked after these steps.

Are these steps necessary?

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .