I discovered that recent OpenSSH has support for tun devices. When it comes to tunnels and VPNs, I always thought the main programme was OpenVPN.
Are there any advantages to using SSH tunnels? What about security? Either one easier to set up?
asked Aug 23, 2009 at 14:07
Add a comment
|
2 Answers
SSH VPN tunnels still use the ssh connection, no? Last I checked it did. And since ssh runs over TCP that means that the VPN runs over TCP.
This is not a good way to do it. A single dropped packet will cause i hickup of ALL communication that's going through the tunnel.
Tunneling IP over TCP is a bad idea.
OpenVPN can use TCP or UDP. UDP is preferred for the reason I explained (poorly).
Better explanation: http://sites.inka.de/~W1011/devel/tcp-tcp.html
That being said, SSH VPN is probably easier to set up.
-
Tunneling TCP over TCP is exceptionally bad, as it really confuses the inner TCP's congestion control.– derobertAug 23, 2009 at 19:40
-
On the other hand, there are often situations where one end of the VPN is behind a firewall or NAT that doesn't handle UDP properly, whereas TCP pretty much always works.– pjc50Oct 27, 2009 at 12:47
-
If your server already has SSH access configured, then obviously using SSH tunnels will work without having to touch the firewall.
OTOH, if your users need access to your server from anywhere in the world, you are probably better off using OpenVPN, as this can be configured to run over port 443 (HTTPS). The reason for this is that in many hotels and other WiFI hotspots traffic through ports other than 80 and 443 is very often disabled and this effectively means your SSH VPN tunnels don't work, whereas OpenVPN can be made to work.
I am sure there are other good differentiators, but this is our reason to use OpenVPN.
answered Aug 23, 2009 at 18:54
