Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I discovered that recent OpenSSH has support for tun devices. When it comes to tunnels and VPNs, I always thought the main programme was OpenVPN.

Are there any advantages to using SSH tunnels? What about security? Either one easier to set up?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

SSH VPN tunnels still use the ssh connection, no? Last I checked it did. And since ssh runs over TCP that means that the VPN runs over TCP.

This is not a good way to do it. A single dropped packet will cause i hickup of ALL communication that's going through the tunnel.

Tunneling IP over TCP is a bad idea.

OpenVPN can use TCP or UDP. UDP is preferred for the reason I explained (poorly).

Better explanation: http://sites.inka.de/~W1011/devel/tcp-tcp.html

That being said, SSH VPN is probably easier to set up.

share|improve this answer
    
Tunneling TCP over TCP is exceptionally bad, as it really confuses the inner TCP's congestion control. –  derobert Aug 23 '09 at 19:40
    
On the other hand, there are often situations where one end of the VPN is behind a firewall or NAT that doesn't handle UDP properly, whereas TCP pretty much always works. –  pjc50 Oct 27 '09 at 12:47
    
derobert: I believe I just said that. –  Thomas Oct 28 '09 at 17:19

If your server already has SSH access configured, then obviously using SSH tunnels will work without having to touch the firewall.

OTOH, if your users need access to your server from anywhere in the world, you are probably better off using OpenVPN, as this can be configured to run over port 443 (HTTPS). The reason for this is that in many hotels and other WiFI hotspots traffic through ports other than 80 and 443 is very often disabled and this effectively means your SSH VPN tunnels don't work, whereas OpenVPN can be made to work.

I am sure there are other good differentiators, but this is our reason to use OpenVPN.

share|improve this answer
    
You can configure SSH to run on any port, such as port 443 –  Rory Jan 14 '10 at 17:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.