SSH tunnel over VPN

PROXYsshvpn

I am using a VPN software which, like all VPNs, changes the system configuration in certain ways to make use of their servers.

Sometimes, I need to use an SSH tunnel proxy. I use Sidestep which automatically sets and unsets the proxy settings on the system when I need to use it. And I'm trying to make sure that when I'm using the SSH tunnel proxy, all the connections are still going through via VPN first, then to the SSH tunnel.

My fear is that when I turn the proxy on, the settings are overridden and my machine directly connects to the proxy server only.

So I connect first to the VPN, then to the proxy server. When I visit a site to check my IP, I see the last IP of the chain (the ssh tunnel proxy).

How can I make sure that the local machine is not directly connecting via the SSH tunnel, overriding the VPN settings?

I tried with say, the traceroute google.com command, but it returns an unknown host error when using both the VPN and the SSH tunnel (same with other commands such as ping). When using JUST the VPN or the proxy, it works as expected, showing two different routes.

Best Answer

The easiest way, right off the bat, is to look at the IP you are connecting from.

When I connect (via SSH) to my Mac or FreeBSD machines, I get a nice little header that looks something like the following:

Last login:  Fri Jan 16 14:20:43 2020 from xxx.xxx.xxx.xxx

Now, if I'm connecting internally, it will be from my private address space, from public, it will be something else, if via VPN, it will be from my VPN service address space.

But that's my last connection.

To check what it is currently, you can check your current IP address:

$ ipconfig getifaddr en0

Again, check the IP space. As for your traffic, unless you've created a firewall rule (pf) on your local Mac to route SSH traffic through a different interface, it will be going through your VPN.

We know this is the case because of your already good diagnostics:

When using JUST the VPN or the proxy, it works as expected, showing two different routes.

Related Solutions

How to ensure that all networking goes through the ssh proxy

Assuming that ssh is running on localhost (or another machine on the local subnet), the easiest thing to do is to shut down your routes so that nothing can get outside. netstat -nr will show you your current routes. Mine looks like this:

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.0.69       UGSc       93     4438    en1

192.168.0.69 is my default route. If I take that route out: route delete default 192.168.0.69 then I cannot get to any machine not wired to my network. Once screen sets up your proxy, you should have access back.

SSH sessions hang after VPN reconnect

Unfortunately, I think each VPN client will be picky about this in its own way. Since the network is dropping from underneath the SSH connection, you will have three scenarios that could cause it to "hang", or just drop (that I can think of).

Data is flowing back and forth, and the connection is gone.
You get a new IP address when reconnecting.
Timeout/Alive conditions trigger before you reconnect.

2 Suggestions...

Use screen (you said you don't want to do this, I know, but it really is the most robust solution. There are scripts out there that can greatly enhance/automate the reconnection process).
Compare your SSH configurations. Usually stored in /etc/ssh_config or similiar.

BTW -- I don't think you should need to close windows, just do "~ ." (tilde dot). Tilde is used to control the ssh session. See the manpage for more details.

Best Answer

Related Solutions

How to ensure that all networking goes through the ssh proxy

SSH sessions hang after VPN reconnect

Related Question