Since learning about https://github.com/apenwarr/sshuttle here on HN, I rarely need to use ssh tunnels on my local machine. Instead, I keep multiple sshuttle sessions running in the background for the private networks I access.
In Tips for Remote Unix Work (SSH, screen, and VNC)apenwarr
sshuttle
Python2010–2024
apenwarr / sshuttle
sshuttle
Wrong project! You should head over to http://github.com/sshuttle/sshuttle
56Distinct people
70Mentions
2Explicit recommenders
8.8KGitHub stars
What to know before exploring
What it is
Wrong project! You should head over to http://github.com/sshuttle/sshuttle
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
sshuttle (https://github.com/apenwarr/sshuttle) is one of my favorite SSH tricks. It behaves like a VPN more than other ssh-based proxies that I've used.
robmccoll used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:17:07 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year70 dated mentions
Observed mentions: 2010-09-08 20:56:13 UTC to 2024-07-28 04:25:32 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2010 | 2010-01-01 00:00:00 UTC | 2011-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 15 | 2 | 13 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 13 | 2 | 11 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 7 | 2 | 5 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
sshuttle: where transparent proxy meets VPN meets ssh
As far as I know, sshuttle is the only program that solves the following
common case:
Your client machine (or router) is Linux, FreeBSD, or MacOS.
You have access to a remote network via ssh.
You don't necessarily have admin access on the remote network.
The remote network has no VPN, or only stupid/complex VPN
protocols (IPsec, PPTP, etc). Or maybe you are the
admin and you just got frustrated with the awful state of
VPN tools.
You don't want to create an ssh port forward for every
single host/port on the remote network.
You hate openssh's port forwarding because it's randomly
slow and/or stupid.
You can't use openssh's PermitTunnel feature because
it's disabled by default on openssh servers; plus it does
TCP-over-TCP, which has terrible performance (see below).
Obtaining sshuttle
From PyPI:
pip install sshuttle
Clone:
git clone https://github.com/sshuttle/sshuttle.git
./setup.py install
Documentation
The documentation for the stable version is available at:
http://sshuttle.readthedocs.org/
The documentation for the latest development version is available at:
http://sshuttle.readthedocs.org/en/latest/
Read the full README on GitHubWhat Hacker News says
15 sourcesOk, not techically part of SSH itself but I think SShuttle[1] is one of the most awesome SSH tricks around.
[1] https://github.com/apenwarr/sshuttle
In SSH TricksThe most useful part of this article for me was that really nice ssh tunnel that they posted. https://github.com/apenwarr/sshuttle
In How I got the turntable.fm gorilla in less than 48 hoursI have the same, but then use sshuttle [1] for a quick secure connection. Only does TCP, but if that doesn't bother you you can get it set up in 2 minutes.
[1] https://github.com/apenwarr/sshuttle
[2] For Lion: https://github.com/thatha/sshuttle/blob/macos_10_7_only_hack...
In Secure your browsing using a home VPNAn example I have found is rtorrent. There is also https://github.com/apenwarr/sshuttle, which looks promising, but I haven't used it. My vps provider doesn't provide tap for openvpn to work.
In Secure your browsing using a home VPNSpecifically, use https://github.com/apenwarr/sshuttle - dead easy and works in most circumstances, and not just for web browsing.
In Ask HN: What's The Best Secure VPN Client for Browsing Open Wi-Fi?Sshuttle - Transparent proxy server that works as a poor man's VPN
Do use EC2 or some other cloud based service? Then you want to use sshuttle.
1) Set up jumpbox.yourdomain.com as the only machine in your cloud with an open ssh port.
2) git clone git://github.com/apenwarr/sshuttle
3) cd sshuttle
4) ./sshuttle -H -r jumpbox.yourdomain.com 0.0.0.0/0
My mind is blown.
Yours will be too.
2 points · Open discussionIf you just want a quick and dirty VPN to tunnel your TCP traffic through, it's probably easier to launch a random EC2 image and run shuttle [1] on your client.
https://github.com/apenwarr/sshuttle
In Setting up OpenVPN on Amazon’s EC2https://github.com/apenwarr/sshuttle/commit/33efa5ac62eaf9cf... is the point where I get confused.
In a normal tunnel setup, one tunnels at the IP layer, and dumps all IP packets into the tunnel. At the far end of the tunnel, packets are sent onwards based on the far end's routing table. Things like DNS "just work" because everything happens at a layer below TCP and UDP. In this system, he's making it work for each non-tcp using layer 4 protocol separately, leading to weirdness like rewriting /etc/hosts.
For tcp, he's nating all traffic locally to a local server, which then multiplexes all incoming traffic into the ssh connection. The remote side then unmultiplexes the data. I don't fully understand how this avoids tcp over tcp. Maybe I'm dumb. [edit: yeah, I'm dumb. the tcp connection is terminated at the local server, the contents are p
Read the rest
umped over the ssh connection, and the remote side opens a new tcp connection]
I wrote this mostly because I read the readme and went "but how does it work?".
The commit log seems to imply DNS has been added: https://github.com/apenwarr/sshuttle/commit/0bf0351d9becae3d... (along with a few subsequent patches)
But I have not tried it.
In Sshuttle - tunnel all your traffic through sshFrom the github.com page
This is how you use it:
git clone git://github.com/apenwarr/sshuttle on your client machine. You'll need root or sudo access, and python needs to be installed.
./sshuttle -r username@sshserver 0.0.0.0/0 -vv
(You may be prompted for one or more passwords; first, the local password to become root using either sudo or su, and then the remote ssh password. Or you might have sudo and ssh set up to not require passwords, in which case you won't be prompted at all.)
That's it! Now your local machine can access the remote network as if you were right there. And if your "client" machine is a router, everyone on your local network can make connections to your remote network.
You don't need to install sshuttle on the remote server; the remote server just needs to have python available. sshuttle will automatically u
Read the rest
pload and run its source code to the remote python interpreter.
This creates a transparent proxy server on your local machine for all IP addresses that match 0.0.0.0/0. (You can use more specific IP addresses if you want; use any number of IP addresses or subnets to change which addresses get proxied. Using 0.0.0.0/0 proxies everything, which is interesting if you don't trust the people on your local network.)
Any TCP session you initiate to one of the proxied IP addresses will be captured by sshuttle and sent over an ssh session to the remote copy of sshuttle, which will then regenerate the connection on that end, and funnel the data back and forth through ssh.
Fun, right? A poor man's instant VPN, and you don't even have to have admin access on the server.
Sshuttle - tunnel all your traffic through ssh
228 points · Open discussionOn OSX this will work for some Flash video implementations, but not others. (BBC iPlayer website: yes, Desktop: no; other UK TV channels: no) You can use https://github.com/apenwarr/sshuttle to transparently proxy all TCP connections (to whitelisted or non-blacklisted IPs) though. OSX and Linux only, though.
In Show HN: My weekend project, tracking the services you can't have in CanadaYou can transparently proxy arbitrary network traffic. See https://github.com/apenwarr/sshuttle for an example. FWIW, I'm only pointing out that HTTPS wins you exactly nothing compared to HTTP for this particular purpose. The concept of the "correct" IP address in the context of NAT and proxies is hazy at best anyway.
In Your IP. In JSONI would agree that Apenwarr is an excellent program. I've been using his sshuttle for some time now.
https://github.com/apenwarr/sshuttle
In "I think that djb redo will turn out to be the Git of build systems."