SSH tunnel

The ssh command allows to create tunnels and forward a port which is useful to bypass NAT. E.g. when you don't have a public IP but have a server or router that have it. This is simplest and popular way of tunneling because not need for a dedicated client. As a downside an encrypted TLS (HTTPS) traffic will be additionally encrypted by SSH. But it's really not a big slowdown. Alternatively you can use pppossh for a full VPN tunneling over SSH.

The simplest tunnel for port forward can be created with a command like ssh -R *:80:127.0.0.1:80 jonh@myhome.jonh.me.

In order to keep tunnel reconnecting after disconnect you need to install and configure the additional service sshtunnel. The service also provides an easy UCI configuration file and has LUCI app to configure from GUI.

To install from a command line use opkg install sshtunnel.

The SSH client included by default on OpenWrt is DropBear dbclient. It's small and supports remote and local tunnels but has limited options. Previously, before the sshtunnel version 5.1 it's package installed as a dependency the full openssh-client. If you have enough of space it's generally recommended to install it with a command opkg install openssh-client.

There is a LUCI app luci-app-sshtunnel that provides a GUI for the sshtunnel. You may install it with opkg install luci-app-sshtunnel. It may be not yet available in the main packages feed.

The UCI configuration is located in /etc/config/sshtunnel. This file is responsible for defining ssh servers and tunnels.

A typical sshtunnel config file contains at least one server specifying the connection to an ssh server and one or more tunnelL, tunnelR or tunnelD defining Local, Remote or Dynamic tunnels.

In most cases there will be only one server defined, but possibly several tunnels to this server.

A minimal server declaration may look like the example below.

config server 'home'
	option user       'jonh'
	option hostname   'myhome.jonh.me'
	option port       '22'

* home will identify this server on the tunnels sections * jonh specifies the username on the remote machine * myhome.jonh.me is the hostname of a remote machine running an SSH server.

The possible options for server sections are listed in the table below:

If you have the openssh-client then you can specify advanced options:

For the openssh-client you can also configure the server options in the /root/.ssh/config file:

Host home
    HostName myhome.jonh.me
    Port 22
    User jonh
    # Allow old DSA keys used by old OpenWrt router
    PubkeyAcceptedKeyTypes +ssh-dss
    HostkeyAlgorithms +ssh-rsa

But you still need to create a corresponding server section and use the Host as hostname'.

See OpenSSH man ssh_config

A complete sshtunnel configuration contains at least one section:

• tunnelR a remote tunnel: Forward a port on the remote host to a service on the local host.
• tunnelL a local tunnel: Forward a port on the local host to a service on the remote host.
• tunnelD a Dynamic Tunnel e.g. SOCKS4/SOCKS5 proxy via remote host.
• tunnelW TUN/TAP VPN. Requires openssh-client.

If no any tunnel were specified for the server then the sshtunnel won't connect to it.

A example for a tunnelR declaration is given below:

config tunnelR local_ssh
        option server         'home'
        option remoteaddress  '*'
        option remoteport     '2222'
        option localaddress   '127.0.0.1'
        option localport      '22'

• * means to accept a connection from any interface on the Server side

Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled. See “SSH Server configuration” bellow

• 2222 is the TCP port to bind on the Server side
• 127.0.0.1 is the OpenWrt side address to where the remote connection will be forwarded
• 22 is the OpenWrt side TCP port where to the remote connection will be forwarded

The equivalent ssh command would be ssh -R *:2222:127.0.0.1:22 jonh@myhome.jonh.me

The possible options for tunnelR sections are listed in the table below:

For a tunnelL the declaration is similar:

config tunnelL server_http
        option server         'home'
        option remoteaddress  '127.0.0.1'
        option remoteport     '8080'
        option localaddress   '*'
        option localport      '80'

• 127.0.0.1 is the Server side address to where the connection will be forwarded
• 8080 is the Server side TCP port to where the local connection will be forwarded
• * means to accept a connection from any interface on the OpenWrt side
• 80 is the local TCP port to bind on the OpenWrt side

The equivalent ssh command would be ssh -L *:80:127.0.0.1:8080 jonh@myhome.jonh.me

The possible options for tunnelL sections are listed in the table below:

A tunnelD declaration will create a SOCKS proxy accessible on the defined local port. This is supported only with the openssh-client.

config tunnelD proxy
        option server         'home'
        option localaddress   '*'
        option localport      '1080'

• * means to accept a connection from any interface on the OpenWrt side
• 1080 is the local TCP port to bind on the OpenWrt side

The equivalent ssh command would be ssh -D *:1080 jonh@myhome.jonh.me

The possible options for tunnelD sections are listed in the table below:

A tunnelW declaration will TUN/TAP devices on client and server to establish a VPN tunnel between them. This is supported only with the openssh-client. You better to use the PPPoSSH.

config tunnelW vpn
	option server           'home'
	option vpntype		'point-to-point'
	option localdev		'any'
	option remotedev	'any'

The equivalent ssh command would be ssh -o Tunnel=point-to-point -w any:any jonh@myhome.jonh.me

The possible options for tunnelW sections are listed in the table below:

See Arch Wiki VPN over SSH

• srv.us works with empty RemoteAddress or set to '*'. You can also set a custom domain as a number 1, 2 etc.
• localhost.run works with empty RemoteAddress or set to '*' but the generated domain will be rotated and changed on next restart. You need a custom domain (paid feature).
• remote.moe works only if a custom domain but this needs for some manual configuration.

See other options in the Awesome tunneling: SSH services

To access an SSH server you need to add your public key to a list of authorized keys. So add your pub key (id_ed25519.pub, id_rsa.pub) to the /root/.ssh/authorized_keys or to the /etc/dropbear/authorized_keys. In LuCI you can do that with System / Administration / SSH-Keys.

For a remote tunnel you also should allow GatewayPorts on the server. For the Dropbear you can edit its config vi /etc/config/dropbear, add the option GatewayPorts 1, reload it with service dropbear reload.

Or by using UCI:

uci set dropbear.@dropbear[0].GatewayPorts=1
uci commit

For the OpenSSHd you need to edit the /etc/ssh/sshd_config, add the GatewayPorts yes, reload with service sshd reload.

mak

• Video: Setup SSH tunnel on router
• OpenWrt - Reverse SSH tunnel in Polish
• OpenWrt SSH tunnel
• howto: SOCKS Proxy SSH Tunnels on OpenWRT
• howto: OpenWrt SSH Tunneling
• sshtunnel SystemD port of the sshtunnel to other SystemD based Linux distros (Ubuntu, Debian etc).
• pppossh an L3 tunnel over SSH
• sshuttle - a Python based SSH VPN.
• autossh - an older SSH re-connection tool
• man ssh_config — OpenSSH client configuration file. Manual
• man ssh — OpenSSH client. Manual
• sslh - multiplexer proxy (e.g. share SSH and HTTPS)