I am looking for a "application tunneling" solution that behaves a similar to an ssl or ssh tunnel but over UDP. One the client end, OpenVPN provides an network interface. I want the client end to just listen on a local port and forward all that traffic over the tunnel it has established.

NOTE: I used the term application tunneling to describe how ssh tunneling behaves vs. how OpenVPN behaves. With an ssh tunnel, a network application connects to localhost:12345. With OpenVPN, an network application talks to the remote IP, which is reached over a tun interface. OpenVPN requires support in the kernel for tun/tap interface, the application tunnel model does not. If someone knows the correct term for this, please let me know in the comments.

  • Why do you want it to be UDP? Can you provide us some more details about what you need this tunnel for? – Zoredache Mar 29 '10 at 20:32
  • I want to be able to tunnel both UDP and TCP based protocols over this. If the tunnel is TCP, then tunneling another TCP protocol over it runs into retransmit problems. Tunneling UDP over TCP also isn't ideal for things that are sensitive to latency. – kbyrd Mar 29 '10 at 20:40
  • I'm looking around myself. I wonder if ssf might work? It's also on github. They advertise it as an ssh that will tunnel udp. (I'm trying to tunnel through a server, but I don't have root over there, so I can't try it out.) – Diagon Dec 14 '15 at 0:41

I think you're looking for Datagram Transport Layer Security. It's essentially SSL/TLS but slightly modified so that it will work over UDP. This is roughly the same thing that OpenVPN uses for its encryption, except that OpenVPN predates DTLS, so the implementation details are probably a somewhat different, but not dramatically so.

Luckily newer releases of products like OpenSSL already support DTLS, so the hard work has been done for you.

| improve this answer | |
  • From the RFC, it looks like a DTLS solution might work. I searched for an example of a ready made DTLS server that looked like it wasn't just an example, but couldn't find one. Any suggestions? – kbyrd Mar 29 '10 at 22:29

OpenVPN can be used in a site-to-site VPN configuration. pfSense has the easiest implementation of this that I've seen around built in; the pfSense box on one end acts as a "server" and the other is configured as a "client", but I put these in "qoutes" because it doesn't matter which end is which to the other hosts on the networks at each end.

Unless configured otherwise, OpenVPN defaults to a UDP port (1194).

If you're looking for 2-way nat traversal with no port forwarding, intermediary servers, spoofing, or DNS hacks you could look at pwnat, based on udptunnel. I haven't yet messed with it but it looks very interesting.

| improve this answer | |
  • I specifically don't want site-to-site. I want something that listens on local ports and forwards that traffic over the tunnel. What I really want is something that doesn't require kernel support for tun/tap or anything like it. I'm looking for lightweight library type solutions that I could port to a variety of different environments. – kbyrd Mar 29 '10 at 18:31
  • The only other thing I can think of offhand is a socks proxy (ssh -D user@ip_address), though you've probably already looked at this and I think it's TCP-only -- you might look around to see if there's a UDP implementation anywhere. – nedm Mar 29 '10 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.