[erikb]

Think of SSH as the secure networking swiss pocket knife but that it is free for everybody to use, learn and script with. Now think how someone could make money out of it. They can't. So they start creating an alternative, that is so complex and hard to understand, that no person alone can manage it, and even the best solutions are unreliable, expensive and corporate. This is something you can sell and argue well that you need a shitload of engineers to maintain. This is VPN.

What should you use if you're smart enough to come to HN for reading? SSH of course.

[mi_lk]

Do you mean you can use SSH for anonymous browsing? I genuinely don’t know how that works out, isn’t that just transfer the risk to the server you ssh into, so you end up having to trust the server? Do you have some links for reference?

[jsjohnst]

SSH has a Socks compliant proxy built in. That said, you are right, you are basically shifting responsibility to the SSH server you are connecting to so you have to trust it the same way you would a VPN provider. As such, it’s essentially the exact same and so GP was clearly misguided.

[erikb]

You can provide the ssh server yourself. Which is not so hard. And security is something different than avoiding tracking. Avoiding tracking is very simply done by not using a centralized proxy which is maintained by someone else (like in VPN). When you are really under attack it's very different and in that case you couldn't trust VPN either. Even the VPN client would be a danger.

[kibwen]

Though this can provide an extra level of defense against MITM, if you trust your personal connection to the internet less than the server's connection to the internet.

[bearbearbear]

All SSH does is move your traffic to a different computer.

When it leaves that computer it's no longer encrypted.

It's not hard to look at unencrypted traffic leaving the computer you've SSH'd into and associate the traffic with the computer you've SSH'd in through.

[jstanley]

> All SSH does is move your traffic to a different computer.

And browsing the internet over a VPN is different... how, exactly?

[subway]

Not to mention incredibly limited IP support. You can forward a few specific ports, or use SOCKS, but that's about it.

[earenndil]

Why is SOCKS limited? Just make whatever you want to send your traffic through proxy it through the SOCKS.

[_joel]

Indeed, ssh -D {port} is something I use heavily (to create a SOCKS5 connection to a remote server, effectively a VPN)

[cat199]

This assumes 'whatever you want to send traffic through' speaks SOCKS.. most things dont. Web yes, but not most other things.

[jsjohnst]

> most things don’t

That’s entirely not true. If you’d said “some”, you’d be right, but “most” is categorically incorrect.

[jsjohnst]

I guess you’ve never heard of TUN/TAP support in SSH?

[0xfeba]

Hm, do DNS queries go through an SSH tunnel?

[kibwen]

Presumably so; when I've tried the SOCKS support built in to Firefox, I've noticed that sites that I have blackholed via my hosts file begin working again.

[erikb]

And VPN encrypts your traffic directly to Facebook? No. At some point it also leaves the VPN's network.

[cat199]

Umm. No.

Want to connect 2 lan's together and have full protocol binding and internal DNS support without mucking with 65535*N-nodes port forwardings?

yeah.

not to mention 'vpn' isn't a product..

so your entire notion of 'making money out of it' makes no sense.

as for commercial: OpenVPN is great, free, and fairly simple to use.

[jsjohnst]

While it’s not the right tool for the job, it is possible to connect two networks together using SSH as the secure transport. Many (most?) good network folks will recoil in horror though about tunneling TCP inside TCP.

[cat199]

Re Full network: How?, without additional software e.g. ppp+socat+ssh along with TUN/TAP or similar, or running a non standard SSH client/server and having various nonstandard utilities on both ends, which imho obviates OP's claim of SSH 'simplicity'/'ubiquity'..

TCP/TCP is another point.. and a good one, yes.

[jsjohnst]

> Re Full network: How?

These articles explain the concept, but it takes nothing but SSH & Linux (albeit it can work on macOS too with additional software):

https://wiki.archlinux.org/index.php/VPN_over_SSH

https://debian-administration.org/article/539/Setting_up_a_L...

http://sgros.blogspot.com/2011/11/ssh-tap-tunnels-using-rout...

I've seen it done before where it was fully transparent to both networks. This required the tunnel to be setup on the default gateway for both networks. Again, as mentioned before and you agreed too, this is not a solution I would ever want to see in production for a company I was at.

> which imho obviates OP's claim of SSH 'simplicity'/'ubiquity'

Which I agree, it isn't simple, but I was replying to someone saying it wasn't possible, not that it is easy to do.