Olaf Titz

Can't speak about security aspects, but: If you ever use SSH to tunnel/forward TCP traffic, you should be aware of certain performance issues [1], due to TCP's re-transmit mis-behaving (stacking) in a TCP-in-TCP scenario. Expect seemingly random delays, followed by bursts of transmission even well below the nominal capacity of the connection. This also causes overall increase in amount of data sent. The same caveat applies to any other TCP-in-TCP tunnel (as opposed to the usual TCP-in-UDP setup), unless one or both tunnel endpoints specifically handle re-transmits properly. [1] http://sites.inka.de/bigred/devel/tcp-tcp.html

In other comments the author seems to already be aware, but for anyone wondering why TCP over TCP is less than ideal, this is a good read: http://sites.inka.de/bigred/devel/tcp-tcp.html

My experience with openvpn is abysmal. It is slow, tunnels tcp-over-tcp the wrong way[0], tunnels udp-over-tcp the wrong way, and the connections were quite fargile. Does anyone have alternatives to recommend? SoftEther looks like the bees knees from the website, but I haven't found trustworthy reviews from real users. [0] http://sites.inka.de/bigred/devel/tcp-tcp.html

Charles Pellegrino/George Zebrowski covers this in _The Killing Star_ (1995). They reason as follows: 1. Any species will place its own survival before that of a different species. 2. Any species that has made it to the top on its planet of origin will be intelligent, alert, aggressive, and ruthless when necessary. 3. They will assume that the first two rules apply to us. So any starfaring species might well destroy another starfaring species -- immediately. In _The Killing Star_ the aliens do so at the first opportunity with high-powered relativistic bombardment. The power that they use dwarfs that generated by asteroid impacts and past mass extictions. They blanket the entire hemisphere of planets with relativistic projectiles! The earth is taken out entirely in just two shots. http://sites.inka.de/mips/reviews/TheKillingStar.html

OpenSSH VPNs suffer from TCP-over-TCP [1]. I'd only use them as a last resort. Sometimes I actually wish SSH would offer UDP support for precisely this use case, but arguably, TCP VPN support is already a stretch in terms of scope for SSH. [1] http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

Does this use TCP over TCP (painful in the face of packet loss[1]) or can you do something like using QUIC for the forward proxy to try to avoid breaking the tunneled TLS connection's retry timers? [1]: http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

> you actually can bring up a tun interface using ssh Beware of TCP over TCP issues[0] when using SSH for tun. [0]: http://sites.inka.de/bigred/devel/tcp-tcp.html

Why TCP Over TCP Is A Bad Idea http://sites.inka.de/bigred/devel/tcp-tcp.html

Will ssh experience timeouts and connection aborts detailed here http://sites.inka.de/bigred/devel/tcp-tcp.html or is that not applicable? Nice script BTW.

Obligatory link about tunneling TCP over TCP: http://sites.inka.de/bigred/devel/tcp-tcp.html (not that it matters when you're trying to tunnel out of university network, but something to keep in mind, especially on lossy connections)

Generally speaking, tunneling TCP inside TCP is a bad idea. Yes, it’ll “mostly” work with the added latency you mentioned, but it can go very poorly if the network starts having packet congestion or dropped packets. If the “outer” VPN is UDP or IPsec, then not as much an issue, but many of the VPN providers commonly used are TCP based (of the ones I spot checked from a google search anyway). And remember, since they are TCPinTCP already, you are just making the situation even more likely to occur. Further reading: http://sites.inka.de/bigred/devel/tcp-tcp.html

The overhead of layer 2/3 packet headers in OpenVPN did not cause such a huge slowdown, its much more likely that OpenVPN was operating in TCP mode, and thus subject to the tcp-in-tcp[1] problem with tunnel internal tcp sessions. Even an extraordinarily slow machine by modern standards can manage 100mbit openVPN without much of an issue. EDIT: did not see UDP results. There is still something else going on here, thats still much too slow for openVPN (without tweaking). [1] http://sites.inka.de/bigred/devel/tcp-tcp.html

http://sites.inka.de/sites/bigred/devel/tcp-tcp.html Even for applications designed to tunnel traffic from the outset (OpenVPN), TCP over TCP is a mess and it's kind of a non-starter for anything that's not a toy (unless you have no other choice, like with certain mobile carriers where path MTU and CGN cause issues).

It's the combination of wireless packets dropping and the audio having to be degraded to 8bit/8kHz to pass between carriers that really brings on the terrible. It's kind of like TCP over TCP [1] -- works well enough a lot of the time, but when it fails, it fails badly because of how the two layers aren't really built for each other. [1]: http://sites.inka.de/bigred/devel/tcp-tcp.html

OpenVPN defaults to tunneling over UDP, but optionally supports TCP. SSH is always over TCP. Here's a bit of info from the man page [1] for anyone who's curious: " OpenVPN is designed to operate optimally over UDP, but TCP capability is provided for situations where UDP cannot be used. In comparison with UDP, TCP will usually be somewhat less efficient and less robust when used over unreliable or congested networks." [1] https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage More detailed info: http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

It's not the TUN/TAP device that gets you; it's tunneling TCP over TCP, which wrecks havoc with TCP's retransmission algorithm[1]. I've personally done measurements and the bandwidth of a TCP connection over a UDP OpenVPN tunnel is just as good as the bandwidth without using a tunnel. In contrast, the bandwidth of a TCP connection over a TCP OpenVPN tunnel is significantly worse. You may theoretically have worse performance with a TUN/TAP tunnel compared to an IPSEC tunnel because the packets have to travel into and out of userspace whereas IPSEC stays in the kernel, but I've never noticed this in practice. In contrast, the TCP performance degradation is very noticeable in practice. [1] http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

There are several possibilities of dealing with UDP traffic in OMR. 1) Multipath VPN (glorytun). Thing is that UDP spread over multiple paths will not as well as MPTCP. MPTCP creates multiple subflows, one for each available path. Each subflow behaves (roughly) as a separate TCP connection, carrying some part of the traffic that goes through the pipe (byte-level splitting of the traffic, not packet-level). What's important here is that each subflow has its own separate congestion control. The congestion control mechanism [1] is a very important aspect of TCP that basically controls its speed in a way that your internet connection is not overloaded and concurrent connections aren't disrupted. QUIC also includes a congestion control mechanism. But with MPTCP, each path is treated individually; with QUIC-over-multipath-VPN, where we just spread UDP packets somehow over multiple paths, the congestion control mechanism will get confused, b/c in the reality the congestion can happen separately on each path which will be hard to see; also, there will be packet reordering which will not improve the situation either. Basically, this is what happens when you try to spread plain TCP over multiple paths naively, and it's the reason why MPTCP was invented in the first place. 2) UDP-over-TCP. In this case, I'm afraid that given that QUIC has its own congestion control, we might get unpleasant side effects similar to "TCP meltdown" as in case of TCP-over-TCP [2] [1]…

WireGuard is a networking primitive. It creates a secure tunnel between two points and only contains the things necessary to make that happen. The rest of what you're asking for can be implementing on top of WireGuard in external tools and I fully expect will be over the next few years seeing the adoption so far. And given you mentioned SSH... That's basically what it is, yes, layer 3 forwarding over SSH except done in a way that's actually usable. (For issues, see e.g., http://sites.inka.de/bigred/devel/tcp-tcp.html) This is a step back towards the unix philosophy of providing simple pieces that can be stacked together to build more complicated things, not a drop-in replacement for OpenVPN et al. Most of us are excited because (1) not everyone is an enterprise, and that "we need everything and the kitchen sink" philosophy makes OpenVPN annoying to work with for everyone else and (2) we'll probably see a lot more options cropping up in this space soon built around WireGuard now that developers have been given a secure primitive to build upon.