How to route specific addresses through a tunnel?

Question

There are certain websites/services which I can only access from the subnet on which my server is located (think of the typical intranet scenario). Is there a way to transparently route traffic that go to these addresses through an SSH tunnel?

Consider the following setup:

My laptop is connected on the home network. It cannot access services on ips X and Y directly. I have an SSH tunnel to a server which is on a subnet that can actually access these services.

Can I somehow automatically encapsulate all the traffic to the subnets of X and Y to go through this tunnel, without having to run the entire VPN solution that would send all my traffic through the server? In other words: all traffic that goes to any other subnet should still go directly from the laptop, without passing through the server (using the tunnel).

Answer 1

You can specify the interface through which to route traffic in the routing table:

sudo route add <host.com> -interface <ppp0>

Where host.com is the hostname or ip that you want to access through the interface, and ppp0 is the link identifier for your vpn shown with the ifconfig command.

Answer 2

Recent versions of OpenSSH support tun/tap network devices for true VPN support. See https://help.ubuntu.com/community/SSH_VPN for some basic documentation (obviously intended for Ubuntu, but the basic principle applies elsewhere.)

Answer 3

Disclaimer: I have not actually tested what I'm going to describe, and indeed it can be completely wrong, but your question is so intriguing that I cannot resist the temptation to draft an answer. :-) Also, the setup here depends on some iptables functionality that might exist only on Linux.

Assuming you want to connect from your laptop to a specific port P1 on server X1, to port P2 on server X2, etc. -- I am going to describe how to route TCP traffic to these specific server+port pairs through an SSH tunnel. Note: the IP addresses X1,X2,etc are the IP addresses of server as seen from the gateway host (the one you SSH into).

1. Select some unused local ports L1 (e.g. 10000), L2 (e.g. 10001), etc. Ports L1, L2, ..., must be all distinct and their number should be equal to the number of distinct (Xn,Pn) server+port pairs.

2. Use iptables to redirect packets directed to Xn:Pn onto localhost:Ln

   iptables -t nat -A OUTPUT -p tcp -d X1 --dport P1 -j DNAT --to-destination localhost:L1 iptables -t nat -A OUTPUT -p tcp -d X2 --dport P2 -j DNAT --to-destination localhost:L2

3. Now SSH to the gateway, using the -L option to tunnel traffic from localhost:Ln to (Xn, Pn):

   ssh gateway.server -L localhost:L1:X1:P1 -L localhost:L2:X2:P2 ...

Example:

# access webserver.intranet (port 80) through localhost:10080
iptables -t nat -A OUTPUT -p tcp -d webserver.intranet --dport 80 -j DNAT --to-destination localhost:10080
ssh gateway.server -L locahost:10080:webserver.intranet:80

Caveats:

• it only works for TCP, if it works at all...

• if you want to access more than one server, it's probably less work to setup a VPN

• it might still be easier to use SSH -D option to simulate a SOCKS proxy and tunnel all your traffic through that.

Answer 4

subnets of X and Y to go through this tunnel, without having to run the entire VPN solution that would send all my traffic through the server?

What you want is the definition of a VPN.

A VPN should not

send all [your] traffic through the server?

If it is, it is not setup properly.

It is assumed that any machine your trying to get access to via a Tunnel or VPN, by definition, not accessible via the Internet. So, only the needed, non-Internet routable address should be routed down the VPN.

If you have a more complicated situation, like only machine X and Y and nothing else. Your IT staff can put those on a subnet for you. Then on your client computer, only route that subnet down the VPN.

Answer 5

Can I somehow automatically encapsulate all the traffic to the subnets of X and Y to go through this tunnel, without having to run the entire VPN solution that would send all my traffic through the server?

This is a bit strange at first glance because that's what a VPN will do for you. SSH tends to be a point-to-point affair, the idea being that you connect one port on your local machine to the port of a remote machine elsewhere; it really wasn't designed for the type of traffic you envision.

In other words: all traffic that goes to any other subnet should still go directly from the laptop, without passing through the server (using the tunnel).

Again, a VPN would take care of that.

If you are concerned about a "heavyweight" solution to getting secure VPN traffic (i.e. you don't want to monkey with it because it would be too complicated) you should really look at OpenVPN, which will do exactly what you are describing. No only would it encapsulate all of the traffic, but it can be done in a way that only traffic destined for those subnets will make the trip over the VPN pipe. I will warn you that you will still need to edit a text file on the local and remote machine(s), but it's fairly easy to get running.

For your purposes, because you do not want the party in the middle (a server) to see your traffic, you would set up the VPN to connect directly from your machine to the remote machine. Any routed packets would be encrypted before leaving your laptop, so you would have 100% end-to-end coverage.

Answer 6

As others have said, if you must "encapsulate all the traffic to the subnets," then you probably want to use VPN.

However, to access just a few services, you might want to use SSH's local port forwarding feature, which is really simple. For example, if you enter (from your laptop):

ssh -N -L 3333:localhost:2222 jump_box

then connecting to localhost:2222, will be just like connecting to localhost:2222 from jump_box. You can use multiple -L options at once, and you can connect to services on other hosts if the ssd_config on jump_box allows it.

You can use autossh with systemd or the like to keep the tunnels up and running.