[Question] possibility to use eduvpn linux-app with sshuttle #650

alexfanqi commented 2025年06月18日 05:32:47 +02:00

Hi,

My machine is behind a server to access public network. I cannot setup VPN services on the server and can only ssh into it, so I think I am left with sshuttle, poor man's option of VPN.

sshuttle by itself works ok, but after I enable the linux-app client, I cannot access the network.
I connected to eduvpn via the OpenVPN protocol because Wireguard seems to fail in my local network.

To work with sshuttle, I guess at least ssh packets cannot be proxied via eduvpn. And eduvpn may need to be forwarded via sshuttle as well. I am not a network expert.

Does anyone know the setup to make eduvpn work with sshuttle or other options to access public network via a server accessible only via ssh? Thanks in advance!

My nat iptables looks like this with sshutils enabled:

alexfanqi@local:/tmp$ sudo iptables -L -t nat
[sudo] password for alexfanqi: 
Chain PREROUTING (policy ACCEPT)
target prot opt source destination 
sshuttle-12300 all -- anywhere anywhere 
Chain INPUT (policy ACCEPT)
target prot opt source destination 
Chain OUTPUT (policy ACCEPT)
target prot opt source destination 
sshuttle-12300 all -- anywhere anywhere 
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination 
Chain sshuttle-12300 (2 references)
target prot opt source destination 
REDIRECT udp -- anywhere _localdnsstub udp dpt:domain redir ports 12299
REDIRECT udp -- anywhere public1.114dns.com udp dpt:domain redir ports 12299
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN tcp -- anywhere localhost 
REDIRECT tcp -- anywhere anywhere redir ports 12300

And route table when sshutils and eduvpn both are enabled:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 inet 127.0.0.1/8 scope host lo
 valid_lft forever preferred_lft forever
 inet6 ::1/128 scope host noprefixroute 
 valid_lft forever preferred_lft forever
2: enp0s13f0u3u2u4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
 link/ether 00:e0:4c:68:27:b4 brd ff:ff:ff:ff:ff:ff
3: wlp0s20f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
 link/ether d2:b5:09:d7:1f:31 brd ff:ff:ff:ff:ff:ff permaddr 8c:17:59:d5:aa:de
 inet 192.168.31.228/24 brd 192.168.31.255 scope global dynamic noprefixroute wlp0s20f3
 valid_lft 27810sec preferred_lft 27810sec
 inet6 xxx scope link noprefixroute 
 valid_lft forever preferred_lft forever
24: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
 link/none 
 inet 10.0.20.130/25 brd 10.0.20.255 scope global noprefixroute tun0
 valid_lft forever preferred_lft forever
 inet6 xxx scope global noprefixroute 
 valid_lft forever preferred_lft forever
 inet6 xxx scope link stable-privacy proto kernel_ll 
 valid_lft forever preferred_lft forever

cheers

Hi, My machine is behind a server to access public network. I cannot setup VPN services on the server and can only ssh into it, so I think I am left with sshuttle, poor man's option of VPN. sshuttle by itself works ok, but after I enable the linux-app client, I cannot access the network. I connected to eduvpn via the OpenVPN protocol because Wireguard seems to fail in my local network. To work with sshuttle, I guess at least ssh packets cannot be proxied via eduvpn. And eduvpn may need to be forwarded via sshuttle as well. I am not a network expert. Does anyone know the setup to make eduvpn work with sshuttle or other options to access public network via a server accessible only via ssh? Thanks in advance! My nat iptables looks like this with sshutils enabled: ``` alexfanqi@local:/tmp$ sudo iptables -L -t nat [sudo] password for alexfanqi: Chain PREROUTING (policy ACCEPT) target prot opt source destination sshuttle-12300 all -- anywhere anywhere Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination sshuttle-12300 all -- anywhere anywhere Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain sshuttle-12300 (2 references) target prot opt source destination REDIRECT udp -- anywhere _localdnsstub udp dpt:domain redir ports 12299 REDIRECT udp -- anywhere public1.114dns.com udp dpt:domain redir ports 12299 RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL RETURN tcp -- anywhere localhost REDIRECT tcp -- anywhere anywhere redir ports 12300 ``` And route table when sshutils and eduvpn both are enabled: ``` 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s13f0u3u2u4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000 link/ether 00:e0:4c:68:27:b4 brd ff:ff:ff:ff:ff:ff 3: wlp0s20f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether d2:b5:09:d7:1f:31 brd ff:ff:ff:ff:ff:ff permaddr 8c:17:59:d5:aa:de inet 192.168.31.228/24 brd 192.168.31.255 scope global dynamic noprefixroute wlp0s20f3 valid_lft 27810sec preferred_lft 27810sec inet6 xxx scope link noprefixroute valid_lft forever preferred_lft forever 24: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500 link/none inet 10.0.20.130/25 brd 10.0.20.255 scope global noprefixroute tun0 valid_lft forever preferred_lft forever inet6 xxx scope global noprefixroute valid_lft forever preferred_lft forever inet6 xxx scope link stable-privacy proto kernel_ll valid_lft forever preferred_lft forever ``` cheers

jwijenbergh commented 2025年08月01日 10:22:31 +02:00

hi, did you ever get this to work?

hi, did you ever get this to work?

jwijenbergh commented 2025年10月09日 14:36:49 +02:00

no response, please reply if still an issue

no response, please reply if still an issue

alexfanqi commented 2026年01月10日 14:56:34 +01:00

@jwijenbergh wrote in #650 (comment):

hi, did you ever get this to work?

I never got this to work. This feature is going to be very useful for people who have restricted network like me, but my knowledge about network development is limited.

@jwijenbergh wrote in https://codeberg.org/eduVPN/linux-app/issues/650#issuecomment-6076147: > hi, did you ever get this to work? I never got this to work. This feature is going to be very useful for people who have restricted network like me, but my knowledge about network development is limited.

jwijenbergh commented 2026年05月11日 12:11:08 +02:00

I don't think there is anything we can do about this, sshuttle is a type of VPN and so is eduVPN, so having both work at the same time is too difficult. The fact you cannot access sshuttle is a "feature" of a default gateway VPN

I don't think there is anything we can do about this, sshuttle is a type of VPN and so is eduVPN, so having both work at the same time is too difficult. The fact you cannot access sshuttle is a "feature" of a default gateway VPN