Date: Sat, 6 Sep 2014 02:52:22 +0000 (UTC) From: John Case <case@SDF.ORG> To: freebsd-net@freebsd.org Subject: How can sshuttle be used properly with FreeBSD (and with DNS) ? Message-ID: <Pine.NEB.4.64.1409060233080.2500@faeroes.freeshell.org>
next in thread | raw e-mail | index | archive | help
I would like to use sshuttle (http://github.com/apenwarr/sshuttle) on FreeBSD. I have it working for TCP connections, but it does not properly tunnel DNS requests. The documentation for sshuttle says that ipfw forward rules will not properly forward UDP packets, and so when it runs on FreeBSD, sshuttle inserts divert rules instead. The project author believes that this will work properly (inserting divert rules to tunnel UDP) but I am not having any success. BUT, I already have a divert rule (and natd running) on this system even before I run sshuttle at all - because the system won't function as a normal gateway unless I use divert/natd. I prefer to run a gateway without divert/natd, but since both sides of this gateway are non-routable IPs, I cannot do that - in order to function as a gateway with 10.x.x.x networks on both sides, I need to run natd/divert. So that means that when sshuttle inserts its own divert rules, they conflict with the existing ones, and I am not running a second natd daemon, so I think it all just falls apart. How can this be fixed ? Is anyone out there using sshuttle on FreeBSD with the --dns switch ? Here is what my ipfw.conf looks like BEFORE I run sshuttle: add 1000 divert natd ip from any to any in via xl0 add 2000 divert natd ip from any to any out via xl0 and in rc.conf: gateway_enable="yes" natd_enable="yes" natd_interface="xl0" Again, this works fine - I have a functioning internet gateway and both of the interfaces on it have non-routable IP address. Then I run sshuttle and it *also* works fine - but only for TCP. It does not tunnel UDP (dns) properly like it is supposed to, and I think the reason is that I already have diverting/natd going on and then I run sshuttle and it inserts another two divert rules into ipfw. But I am not sure wha the fix would be ... Thanks.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.4.64.1409060233080.2500>