Sorry that I might be wrong, yet I have some impressions from QEMU that SLIRP has the ability to do both ppp server and NAT stunt the same time.

The situation is, I'm under a very limited network environment, yet the organization which I work for provides a "jump server" which could reach out the Internet.

The sshd_config on that jump server prohibits tunneling, and thus the "ssh -D" socks server trick won't cut.

Currently, I have fired up a ssh connection and let pppd on my local machine to do its PPP tasks with the ssh-allocated pty :

sudo pppd nodetach noproxyarp noauth pty \
"ssh -t jump_server /path/to/slirp -P " \
netmask connect-delay 5000

Then, I add a route rule to test the connection :

sudo ip route add <some_telnet_server> dev ppp0
telnet some_telnet_server

However, the telnet fails. After tearing down the connection, SLIRP log said it received some packets yet it barely transmitted packets. So I guess it's a configuration issue ?

Yet I'm struggling to understand how to configure SLIRP to NAT my connection. (It seems that QEMU modifies slirp very heavily ?)

Is there any cheat sheet for such purpose ? I have searched and read several articles[1][2][3], yet none of them mentions the details of NAT/routing configuration.

[1] https://jdimpson.livejournal.com/3330.html

[2] https://workhorselaboratories.net/ssh-ppp-and-slirp/

[3] https://tldp.org/HOWTO/Firewall-Piercing/x189.html

  • It sounds like you're asking us to help you bypass a deliberate security control at an organization you work at. What is your intent here?
    – mikem
    Dec 30, 2020 at 8:54
  • The intent is to fetch building dependencies. The jump server is provided for that reason. Yet it's painful to use. The ITs asked workers to wget stuffs on that machine.
    – Ruinland
    Dec 30, 2020 at 9:12
  • It sounds like the approved method is wget and that tunnels, of any kind, are intentionally prohibited. Security policy is rarely convenient, but it may be there for good reasons.
    – mikem
    Dec 30, 2020 at 9:36
  • slirp can only do NAT and will do it naturally: it will use the available BSD socket API on the host to initiate the actual connections to "outside". so when you initiate a TCP connection to, slirp will "route" it by opening a TCP connection to (using system calls such as socket() and connect() and not even bind() so source port isn't preserved).
    – A.B
    Dec 30, 2020 at 16:07


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.