{"id":749,"date":"2019-12-05T23:42:57","date_gmt":"2019-12-06T07:42:57","guid":{"rendered":"https:\/\/angrysysadmins.tech\/?p=749"},"modified":"2019-12-05T23:42:57","modified_gmt":"2019-12-06T07:42:57","slug":"ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines","status":"publish","type":"post","link":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/","title":{"rendered":"SSH TAP VPN: Using SSH to Create a Layer 2 VPN between Two Machines"},"content":{"rendered":"<p>SSH truly is the best protocol ever invented by humans in my opinion, and you can quote me on that. It is a Swiss army knife, and in the right hands, it can be used for any situation. One of the things it can be used for is a Layer 2 VPN through a TAP adapter. Its quite useful, as many networks that bock VPN&#8217;s wont always block ssh.<\/p>\n<p>&nbsp;<\/p>\n<p>First, we need to set some local options. With the <code>-o<\/code> flag, you can set an SSH configuration option. In this instance, we need to set <code>PermitLocalCommand<\/code> to yes to allow a local command to execute after a successful connection. with the option <code>-o \"PermitLocalCommand=yes\"<\/code> it will set this option for this command only.<\/p>\n<p>&nbsp;<\/p>\n<p>Now we need to run the local command after a successful connection. you will need to modify this for your desired setup, but for mine, I run <code>-o \"LocalCommand=ifconfig tap5 up &amp;&amp; ifconfig tap5 10.0.25.1 netmask 255.255.255.0\"<\/code>, with tap5 being the TAP adapter created on the local machine going to the remote machine.<\/p>\n<p>&nbsp;<\/p>\n<p>Next, we need to set the option for the tunnel to be a Layer 2 tunnel. with the option <code>-o Tunnel=ethernet<\/code><\/p>\n<p>&nbsp;<\/p>\n<p>Now we need to set the TAP adapter number. I would not leave it default. With the option <code>-w 5:5<\/code> I set the tap adapter to be tap5 on both local and remote machines.<\/p>\n<p>&nbsp;<\/p>\n<p>Next, set the remote server with the option <code>-t root@yourip<\/code><\/p>\n<p>&nbsp;<\/p>\n<p>I&#8217;d recommend that you change the connection timeout to something like 10 seconds. use <code>-o ConnectTimeout=10<\/code> to set it for the command.<\/p>\n<p>&nbsp;<\/p>\n<p>Lastly, run a command on the remote machine to set the TAP adapter ip address. with <code>\"ifconfig tap5 up &amp;&amp; ifconfig tap5 10.0.25.2 netmask 255.255.255.0\"<\/code> at the end of the command, it will execute it on the remote computer upon a successful connection.<\/p>\n<p>&nbsp;<\/p>\n<p>Now stitch the giant command together and you got your one liner command to create an SSH tunnel. Here is mine:<\/p>\n<pre>ssh -o \"PermitLocalCommand=yes\" \\\r\n-o \"LocalCommand=ifconfig tap5 up &amp;&amp; ifconfig tap5 10.0.25.1 netmask 255.255.255.0\" \\\r\n-o Tunnel=ethernet \\\r\n-w 5:5 \\\r\n-t $RemoteUsername@$RemoteServerIP \\\r\n-o ConnectTimeout=10 \\\r\n\"ifconfig tap5 up &amp;&amp; ifconfig tap5 10.0.25.2 netmask 255.255.255.0\"<\/pre>\n<p>You can add a &#8220;-v&#8221; to verify that the connection is successful. You will need to setup firewall rules if you want to use this for something. I use this basically as a 2 host network with the remote host acting as a gateway\/router for getting into services on the local machine. If you plan on doing this in production, make sure to use key biased authentication instead of password, as that is much more secure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SSH truly is the best protocol ever invented by humans in my opinion, and you can quote me on that. It is a Swiss army knife, and in the right hands, it can be used for any situation. One of the things it can be used for is a Layer 2 VPN through a TAP <br \/><a class=\"read-more-button\" href=\"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/\">Read More &raquo;<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,119],"tags":[6,175,174],"coauthors":[39],"class_list":["post-749","post","type-post","status-publish","format-standard","hentry","category-linux","category-vpn","tag-linux","tag-ssh","tag-vpn"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SSH TAP VPN: Using SSH to Create a Layer 2 VPN - Angry Sysadmins<\/title>\n<meta name=\"description\" content=\"SSH can be used to build a Layer 2 VPN between hosts, using it&#039;s protocol instead of something like OpenVPN. Here is how to do that.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSH TAP VPN: Using SSH to Create a Layer 2 VPN - Angry Sysadmins\" \/>\n<meta property=\"og:description\" content=\"SSH can be used to build a Layer 2 VPN between hosts, using it&#039;s protocol instead of something like OpenVPN. Here is how to do that.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/\" \/>\n<meta property=\"og:site_name\" content=\"Angry Sysadmins\" \/>\n<meta property=\"article:published_time\" content=\"2019-12-06T07:42:57+00:00\" \/>\n<meta name=\"author\" content=\"Ryan Parker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ryan Parker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/\"},\"author\":{\"name\":\"Ryan Parker\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#\\\/schema\\\/person\\\/651321cd35645fb6a4d8a75b7bc7c199\"},\"headline\":\"SSH TAP VPN: Using SSH to Create a Layer 2 VPN between Two Machines\",\"datePublished\":\"2019-12-06T07:42:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/\"},\"wordCount\":392,\"commentCount\":0,\"keywords\":[\"Linux\",\"SSH\",\"VPN\"],\"articleSection\":[\"Linux\",\"VPN\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/\",\"name\":\"SSH TAP VPN: Using SSH to Create a Layer 2 VPN - Angry Sysadmins\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#website\"},\"datePublished\":\"2019-12-06T07:42:57+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#\\\/schema\\\/person\\\/651321cd35645fb6a4d8a75b7bc7c199\"},\"description\":\"SSH can be used to build a Layer 2 VPN between hosts, using it's protocol instead of something like OpenVPN. Here is how to do that.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2019\\\/12\\\/grassyloki\\\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/angrysysadmins.tech\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSH TAP VPN: Using SSH to Create a Layer 2 VPN between Two Machines\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#website\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/\",\"name\":\"Angry Sysadmins\",\"description\":\"A site full of angry sysadmins here to vent and help\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/angrysysadmins.tech\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#\\\/schema\\\/person\\\/651321cd35645fb6a4d8a75b7bc7c199\",\"name\":\"Ryan Parker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g664d0e05248e51cb1d71b3f66c6f929d\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g\",\"caption\":\"Ryan Parker\"},\"description\":\"Professionally im a Infrastructure Security Specialist. I current maintain a homelab with about 3TB of RAM, 240+ TB of storage, tons of CPU cores, and 100gbit networking backbone in the garage running up my electricity bill.\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/author\\\/grassyloki\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SSH TAP VPN: Using SSH to Create a Layer 2 VPN - Angry Sysadmins","description":"SSH can be used to build a Layer 2 VPN between hosts, using it's protocol instead of something like OpenVPN. Here is how to do that.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/","og_locale":"en_US","og_type":"article","og_title":"SSH TAP VPN: Using SSH to Create a Layer 2 VPN - Angry Sysadmins","og_description":"SSH can be used to build a Layer 2 VPN between hosts, using it's protocol instead of something like OpenVPN. Here is how to do that.","og_url":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/","og_site_name":"Angry Sysadmins","article_published_time":"2019-12-06T07:42:57+00:00","author":"Ryan Parker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ryan Parker","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/#article","isPartOf":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/"},"author":{"name":"Ryan Parker","@id":"https:\/\/angrysysadmins.tech\/#\/schema\/person\/651321cd35645fb6a4d8a75b7bc7c199"},"headline":"SSH TAP VPN: Using SSH to Create a Layer 2 VPN between Two Machines","datePublished":"2019-12-06T07:42:57+00:00","mainEntityOfPage":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/"},"wordCount":392,"commentCount":0,"keywords":["Linux","SSH","VPN"],"articleSection":["Linux","VPN"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/","url":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/","name":"SSH TAP VPN: Using SSH to Create a Layer 2 VPN - Angry Sysadmins","isPartOf":{"@id":"https:\/\/angrysysadmins.tech\/#website"},"datePublished":"2019-12-06T07:42:57+00:00","author":{"@id":"https:\/\/angrysysadmins.tech\/#\/schema\/person\/651321cd35645fb6a4d8a75b7bc7c199"},"description":"SSH can be used to build a Layer 2 VPN between hosts, using it's protocol instead of something like OpenVPN. Here is how to do that.","breadcrumb":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/angrysysadmins.tech\/index.php\/2019\/12\/grassyloki\/ssh-tap-vpn-using-ssh-to-create-a-layer-2-vpn-between-two-machines\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/angrysysadmins.tech\/"},{"@type":"ListItem","position":2,"name":"SSH TAP VPN: Using SSH to Create a Layer 2 VPN between Two Machines"}]},{"@type":"WebSite","@id":"https:\/\/angrysysadmins.tech\/#website","url":"https:\/\/angrysysadmins.tech\/","name":"Angry Sysadmins","description":"A site full of angry sysadmins here to vent and help","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/angrysysadmins.tech\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/angrysysadmins.tech\/#\/schema\/person\/651321cd35645fb6a4d8a75b7bc7c199","name":"Ryan Parker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g664d0e05248e51cb1d71b3f66c6f929d","url":"https:\/\/secure.gravatar.com\/avatar\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g","caption":"Ryan Parker"},"description":"Professionally im a Infrastructure Security Specialist. I current maintain a homelab with about 3TB of RAM, 240+ TB of storage, tons of CPU cores, and 100gbit networking backbone in the garage running up my electricity bill.","url":"https:\/\/angrysysadmins.tech\/index.php\/author\/grassyloki\/"}]}},"_links":{"self":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts\/749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/comments?post=749"}],"version-history":[{"count":7,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts\/749\/revisions"}],"predecessor-version":[{"id":760,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts\/749\/revisions\/760"}],"wp:attachment":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/media?parent=749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/categories?post=749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/tags?post=749"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/coauthors?post=749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}