Skip to content

Connects your PC, Raspberry PI, OpenWRT router to an SSH tunnel and routes all traffic through it. Also supports simple tun2http.

License

Notifications You must be signed in to change notification settings

PocketMiner82/ConnectSSHTunnel

Repository files navigation

ConnectSSHTunnel

Connects your PC, Raspberry Pi, OpenWRT router to an SSH tunnel and routes all traffic through it.
Also has simple proxy connect script to just route all traffic through the proxy (tun2http) without using SSH tunnel and server.

Features

  • Auto reconnect if SSH/proxy connection drops
  • Auto detect gateway (router)
  • Revert changes on exit (CTRL+C)
  • authenticated HTTP Proxy support

Install (on Raspberry Pi 4 with OpenWRT/ImmortalWRT)

Currently, this install procedure is only tested on OpenWRT/ImmortalWRT on a Raspberry Pi 4 and Ubuntu 22.04.3 LTS.
You need access to the internet to perform the installation steps.

  • Install the dependencies (skip this step if you followed the Example below)

    • OpenWRT/ImmortalWRT:
      opkg update
      opkg install coreutils-base64 procps-ng-pkill coreutils-dirname openvpn ncat openssh-client sshpass bash git-http
      You also need to install GOST for the proxy_connect.sh script.
      If you are using ImmortalWRT, then you can also install it by using the following command:
      opkg install gost
    • Ubuntu:
      apt install coreutils procps openvpn ncat openssh-client sshpass bash git
  • If you are using OpenWRT/ImmortalWRT, make sure that the gateway metric of your WAN/LAN interface is set to 600. You can find this setting under

    Network->Interfaces->Edit button on your WAN interface->Advanced Settings->Use gateway metric
    

    This is already configured correctly if you followed the install steps in the Example down below.

  • Clone this repository

    git clone https://github.com/PocketMiner82/ConnectSSHTunnel.git
    cd ConnectSSHTunnel
  • Copy the correct badvpn binary or build your own. The target name MUST be badvpn-tun2socks. The prebuilt binaries are built from here. Also see the LICENSE_badvpn file in the directory. For OpenWRT/ImmortalWRT (aarch64) on a Raspberry Pi 4:

    cp badvpn_compiled/badvpn-tun2socks_openwrt_rpi4_aarch64 badvpn-tun2socks
  • Run the script once to copy the config file.

    ./connect_ssh_tunnel.sh
  • Edit config.sh (nano config.sh if you have nano installed) DO NOT edit default_config.sh!

  • Now connect the Device to the Network where you want/have to use the ssh tunnel or proxy connect script.

  • For SSH Tunnel: Make sure, the certificate of the server you specified in config to connect is trusted. If you are not sure run this script (replace the placeholders before!), which will open a normal ssh connection to the server:

    ./ssh_open.sh <server_port> <server_user>

    Accept the certificate.

  • Finally, the script can be started:

    ./connect_ssh_server.sh

    Or for proxy_connect.sh:

    ./proxy_connect.sh

    Note that the script must be run as root, so you may need to prefix the command above with sudo.

  • If you want to start the script on boot, add this to /etc/rc.local, in the line before exit. This may only work on OpenWRT/ImmortalWRT.

    (/bin/bash /path/to/connect_ssh_server.sh &) > /dev/null 2>&1

    Or for proxy_connect.sh:

    (/bin/bash /path/to/proxy_connect.sh &) > /dev/null 2>&1

Example: Use a Raspberry Pi 4 as an access point that automatically routes all traffic through an HTTP proxy or an SSH tunnel

  • Warning! This is meant to be used only in the local area network and not as a "real" router/gateway that is directly connected to the internet. Use with care!
  • Open this Website to configure ImmortalWRT. This instruction was tested on version 23.05.1.
  • You need to put these packages in Installed Packages (replace the default ones with these):
    automount base-files bcm27xx-gpu-fw bcm27xx-utils brcmfmac-nvram-43455-sdio busybox ca-bundle cpufreq cypress-firmware-43455-sdio dnsmasq-full dropbear firewall4 fstools ipv6helper iwinfo kmod-brcmfmac kmod-fs-vfat kmod-hwmon-pwmfan kmod-nft-offload kmod-nls-cp437 kmod-nls-iso8859-1 kmod-sound-arm-bcm2835 kmod-sound-core kmod-thermal kmod-usb-hid libc libgcc libustream-openssl logd mkf2fs mtd netifd nftables opkg partx-utils ppp ppp-mod-pppoe procd procd-seccomp procd-ujail uci uclient-fetch urandom-seed wpad-basic-mbedtls coreutils-base64 procps-ng-pkill coreutils-dirname openvpn ncat openssh-client sshpass bash git-http gost nano-full htop libsensors kmod-usb-net-rtl8152 liblucihttp-lua liblucihttp0 luci luci-app-firewall luci-app-opkg luci-app-sqm luci-base luci-compat luci-lib-base luci-lib-ip luci-lib-jsonc luci-lib-nixio luci-mod-admin-full luci-mod-network luci-mod-status luci-mod-system luci-proto-ipv6 luci-proto-ppp luci-theme-bootstrap rpcd-mod-luci kmod-usb3
    
    You need to put this script in the Script to run on first boot (uci-defaults) section:
    # /etc/config/dhcp
    uci del dhcp.lan
    # /etc/config/dropbear
    uci set dropbear.@dropbear[0].GatewayPorts='on'
    uci del dropbear.@dropbear[0].Interface
    # /etc/config/firewall
    uci del firewall.cfg02dc81.network
    uci del firewall.cfg03dc81.network
    uci add_list firewall.cfg03dc81.network='wan'
    uci add_list firewall.cfg03dc81.network='wan6'
    uci add_list firewall.cfg02dc81.device='tun0'
    uci add firewall rule # =cfg0e92bd
    uci set firewall.@rule[-1].name='Allow LuCI'
    uci set firewall.@rule[-1].src='wan'
    uci set firewall.@rule[-1].dest_port='80'
    uci set firewall.@rule[-1].target='ACCEPT'
    uci add firewall rule # =cfg0f92bd
    uci set firewall.@rule[-1].name='Allow SSH'
    uci set firewall.@rule[-1].src='wan'
    uci set firewall.@rule[-1].dest_port='22'
    uci set firewall.@rule[-1].target='ACCEPT'
    # /etc/config/network
    uci del network.lan
    uci set network.wan=interface
    uci set network.wan.proto='dhcp'
    uci set network.wan.device='eth0'
    uci set network.wan.metric='600'
    # /etc/config/wireless
    uci del wireless.default_radio0
    uci commit
    
    cat << "EOF" > /etc/uci-defaults/99-connectsshtunnel
    # /etc/config/dhcp
    uci set dhcp.lan=dhcp
    uci set dhcp.lan.interface='lan'
    uci set dhcp.lan.start='100'
    uci set dhcp.lan.limit='150'
    uci set dhcp.lan.leasetime='12h'
    uci set dhcp.lan.start='10'
    uci set dhcp.lan.limit='240'
    uci set dhcp.@dnsmasq[0].rebind_protection='0'
    uci del dhcp.@dnsmasq[0].local
    uci del dhcp.@dnsmasq[0].domainneeded
    # /etc/config/firewall
    uci add_list firewall.cfg02dc81.network='lan'
    # /etc/config/network
    uci set network.lan=interface
    uci set network.lan.proto='static'
    uci set network.lan.device='br-lan'
    uci set network.lan.ipaddr='192.168.1.1'
    uci set network.lan.netmask='255.255.255.0'
    uci set network.lan.metric='600'
    uci del network.cfg030f15.ports
    uci set network.cfg030f15.bridge_empty='1'
    uci set network.cfg030f15.mtu='1500'
    uci set network.cfg030f15.macaddr='D8:3A:DD:13:EF:AB'
    # /etc/config/wireless
    uci set wireless.wifinet0=wifi-iface
    uci set wireless.wifinet0.device='radio0'
    uci set wireless.wifinet0.mode='ap'
    uci set wireless.wifinet0.ssid='MyAP'
    uci set wireless.wifinet0.encryption='psk2'
    uci set wireless.wifinet0.key='00000000'
    uci set wireless.wifinet0.network='lan'
    uci set wireless.radio0.channel='40'
    uci set wireless.radio0.cell_density='0'
    uci set wireless.radio0.country='DE'
    uci commit
    
    sed -i -E 's@https://mirrors.vsean.net/openwrt/(.*)/@https://downloads.immortalwrt.org/\1/@g' /etc/opkg/distfeeds.conf
    reboot now
    EOF
    
    reboot now
  • Click on the REQUEST BUILD button and wait until the firmware is built. Then download the FACTORY image.
  • Use a tool like the Raspberry Pi Imager to flash the image to a USB Stick
  • Open the cmdline.txt file in the boot partition of the stick and change the root=... to root=/dev/sda2
  • (If you run out of space later on, you may want to increase the ext4 partition (the second partition) that was created by the installer on the stick to fill the whole stick using a tool like GParted)
  • Plug in the stick and connect an ethernet cable to a router that provides internet without proxy or ssh tunnel (e.g. your home router).
  • Then connect power to the Pi. It will reboot twice. The default configuration is an example for enabeling the 5 GHz Band in Germany, with the SSID "MyAP" and the password "00000000". You should change those values! You also want to open the web interface and set a password for the root user!
  • PS: you should also be able now to SSH into the Pi by using ssh root@immortalwrt
  • Now simply follow the steps in Install and after that, the traffic of anyone connected to the wifi should be routed through your SSH tunnel and/or HTTP proxy!

About

Connects your PC, Raspberry PI, OpenWRT router to an SSH tunnel and routes all traffic through it. Also supports simple tun2http.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Languages