sshuttle is the only program that solves the following common case:

• Your client machine (or router) is Linux, FreeBSD, or MacOS.
• You have access to a remote network via ssh.
• You don’t necessarily have admin access on the remote network.
• The remote network has no VPN, or only stupid/complex VPN protocols (IPsec, PPTP, etc). Or maybe you are the admin and you just got frustrated with the awful state of VPN tools.
• You don’t want to create an ssh port forward for every single host/port on the remote network.
• You hate openssh’s port forwarding because it’s randomly slow and/or stupid.
• You can’t use openssh’s PermitTunnel feature because it’s disabled by default on openssh servers; plus it does TCP-over-TCP, which has terrible performance (see below).

sshuttle is not exactly a VPN and not exactly port forwarding. It’s kind of both, and kind of neither.

It’s like a VPN since it can forward every port on an entire network, not just ports you specify. Conveniently, it lets you use the “real” IP addresses of each host rather than faking port numbers on localhost.

On the other hand, the way it works is more like ssh port forwarding than a VPN. Normally, a VPN forwards your data one packet at a time, and doesn’t care about individual connections; ie. it’s “stateless” with respect to the traffic. sshuttle is the opposite of stateless; it tracks every single connection.

You could compare sshuttle to something like the old Slirp program, which was a userspace TCP/IP implementation that did something similar. But it operated on a packet-by-packet basis on the client side, reassembling the packets on the server side. That worked okay back in the “real live serial port” days because serial ports had predictable latency and buffering.

But you can’t safely just forward TCP packets over a TCP session (like ssh) because TCP’s performance depends fundamentally on packet loss; it must experience packet loss in order to know when to slow down! At the same time, the outer TCP session (ssh, in this case) is a reliable transport, which means that what you forward through the tunnel never experiences packet loss. The ssh session itself experiences packet loss, of course, but TCP fixes it up and ssh (and thus you) never know the difference. But neither does your inner TCP session, and extremely screwy performance ensues.

sshuttle assembles the TCP stream locally, multiplexes it statefully over an ssh session, and disassembles it back into packets at the other end. So it never ends up doing TCP-over-TCP. It’s just data-over-TCP, which is safe.

Changelog v1.0.4

Fixed

• Allow Mux() flush/fill to work with python < 3.5
• Fix parse_hostport to always return string for host.
• Require -r/–remote parameter.
• Add missing package in OpenWRT documentation.
• Fix doc about –listen option.
• README: add Ubuntu.
• Increase IP4 ttl to 63 hops instead of 42.
• Fix formatting in installation.rst

Install

sudo pip install sshuttle
or
git clone https://github.com/sshuttle/sshuttle.git
cd sshuttle
sudo ./setup.py install

Usage

Forward all traffic:

sshuttle -r username@sshserver 0.0.0.0/0