I recently "bought" a VPS that I want to use as a Proxy to be able to use some sites and stuff that I can't reach from germany.

Since I was yet too lazy to set up Squid and OpenVPN (which I currently think is needed) I use ssh-tunneling.

Now after a couple of weeks I asked myself if ssh-tunneling wasn't just fine, or - and that is my question - if there are any caveats/contras/drawbacks that I need to have in mind?

  • 2
    For what it's worth, OpenVPN is extremely easy to set up using a static key if you are going from Linux to Linux. It's a bit trickier if one of your machines is Windows, but doable. bit.ly/ujkD2 Commented Mar 19, 2012 at 14:01

4 Answers 4


The performance problem arise when you are tunneling TCP over TCP because you have two layers doing adaptive corrections (slow start, congestion avoidance, fast restransmit see RFC2001).

Not being aware of one another they will experience great difficulties if you have loss on the outer connection.

This page describes the phenomenon in detail.

Rather than sticking with the TCP over TCP problem have a look at sshuttle which prevents it.
Have a look at the section named "Theory of Operation" for even more details about this situation.

  • Doesn't the inner layer know that it's talking to the loopback interface?
    – Random832
    Commented Mar 19, 2012 at 13:56
  • About your question the problem is that TCP doesn't support disabling those "optimizations", even if it were somehow "aware of it's position" as an inner stream it can't do anything. The problem here is the outer adaptive behavior will disrupt the inner one, which will try to adapt by slowing retransmission for example although the outer TCP stream is already adapting for that.
    – Shadok
    Commented Mar 19, 2012 at 14:10
  • I was thinking about the case where it's a normal tunneled TCP connection, not "TCP over IP over PPP over TCP" - in that case there's not actually a second TCP protocol stack - ssh is just forwarding a byte stream. And I didn't mean "aware of its position as an inner stream", I meant how in this situation it would have a loopback interface (the local port ssh is listening on) as its destination.
    – Random832
    Commented Mar 19, 2012 at 14:30
  • OP talked about "some sites", I assumed he was doing HTTP over SocksV5 through SSH, which means he's doing TCP over TCP (SSH itself is TCP and the HTTP inside the tunnel flows over another TCP streams, which is encapsulated in SSH).
    – Shadok
    Commented Mar 19, 2012 at 16:21
  • 1
    @Shadok I am pretty sure your conclusions are not true. apenwarr was referring to tun/tap tunneling which results in tcp-over-tcp. SOCKSv5 is does not suffer from the same problems but does not work transparently with all applications (while tun/tap is just another network interface so it can be handled transparently).
    – jpc
    Commented Oct 24, 2016 at 21:32

One thing I can think of out of my mind is performance. But that really depends on what kind of stuff you are tunnelling.

  • What kind of performance? Bandwidth? I currently use it to access hulu and some youtube videos that are blocked.
    – nocksock
    Commented Mar 19, 2012 at 11:34
  • 1
    CPU overhead (encryption) and possibly latency, most likely.
    – XTL
    Commented Mar 20, 2012 at 10:19

Normally I've found that latency increases but throughput is fine (90%) of normal with SSH tunnelling. Be sure to set ServerAliveInterval to prevent disconnects, and wrap it in a script to keep restarting the tunnel on failure.

The main drawback is that it's a per-TCP port tunnel, unless you use SOCKS. SOCKS is fine but the latency seems to increase even more with it, and of course, not every client supports SOCKS.

You may need to run GatewayPorts on the client or SSH server to allow others to connect through your tunnel. On the server this requires root access to the sshd_config.

The main performance caveat (as others note) is that unreliable connections likely do not fare well with this approach, as TCP's algorithms don't react well under encapsulation.

That said, SSH seems to "do the right thing" most of the time.

  • 1
    The problem with unreliable connections you observe is probably related to the increased latency and handshakes which need to be repeated when connections drop. SSH port forwarding does not do tcp-over-tcp encapsulation.
    – jpc
    Commented Oct 24, 2016 at 21:35

There shouldn't be TCP-over-TCP problems for SSH tunneling.

ssh decapsulates and re-encapsulates TCP, so you don't have classic TCP-over-TCP issues




You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .