net/pppossh/README.md

   1 This package will add the so-called `pppossh` protocol support to OpenWrt.  The idea is mainly from [`pvpn` project](https://github.com/halhen/pvpn) (poor man's VPN over SSH).
   2
   3 PPPoSSH is generally not considered a network setup for production use mainly due to the TCP-over-TCP styles of traffic transport, but it can be quite handy for personal use.  And with what's already in OpenWrt, it is really easy and takes little extra space to configure it up running.
   4
   5 ## Prerequisites and dependency.
   6
   7 `pppossh` depends on either `dropbear` or `openssh-client`; `dropbear` is normally enabled in OpenWrt by default.
   8
   9 The following requirements need to be fulfilled for it to work.
  10
  11 - A SSH account on the remote machine with `CAP_NET_ADMIN` capability is required.
  12 - Public key authentication must be enabled and setup properly.
  13
  14         Public key of the one generated automatially by dropbear can be induced by the following command.  But you can always use your own (dropbear can work with OpenSSH public key).
  15
  16                 dropbearkey -y -f /etc/dropbear/dropbear_rsa_host_key
  17
  18 - SSH server's fingerprint has to be present in `~/.ssh/known_hosts` for the authentication to proceed in an unattended way.
  19
  20         Manually logging in at least once to the remote server from OpenWrt should do this for you.
  21
  22 ## How to use it.
  23
  24 The protocol name to use in `/etc/config/network` is `pppossh`.  Options are as described below.
  25
  26 - `server`, SSH server name
  27 - `port`, SSH server port (defaults to `22`).
  28 - `sshuser`, SSH login username
  29 - `identity`, list of client private key files.  `~/.ssh/id_{rsa,dsa}` will
  30    be used if no identity file was specified and at least one of them must be
  31    valid for the public key authentication to proceed.
  32 - `ipaddr`, local ip address to be assigned.
  33 - `peeraddr`, peer ip address to be assigned.
  34 - `ssh_options`, extra options for the ssh client.
  35 - `use_hostdep`, set it to `0` to disable the use of `proto_add_host_dependency`.  This is mainly for the case that the appropriate route to `server` is not registered to `netifd` and thus causing a incorrect route being setup.
  36
  37 ## Tips
  38
  39 An `uci batch` command template for your reference.  Modify it to suite your situation.
  40
  41         uci batch <<EOF
  42         delete network.fs
  43         set network.fs=interface
  44         set network.fs.proto=pppossh
  45         set network.fs.sshuser=root
  46         set network.fs.server=ssh.example.cn
  47         set network.fs.port=30244
  48         add_list network.fs.identity=/etc/dropbear/dropbear_rsa_host_key
  49         set network.fs.ipaddr=192.168.177.2
  50         set network.fs.peeraddr=192.168.177.1
  51         commit
  52         EOF
  53
  54 Allow forward and NAT on the remote side (`ppp0` is the peer interface on the remote side.  `eth0` is the interface for Internet access).
  55
  56         sysctl -w net.ipv4.ip_forward=1
  57         iptables -t filter -A FORWARD -i ppp0 -j ACCEPT
  58         iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  59
  60 It's possible that pppd may output protocol negotiation incompatibilities issues to syslog, such as something like the following which did not hurt the connectivity and was annoying only because we thought it can do better.
  61
  62         Sun Oct 25 09:45:14 2015 daemon.err pppd[22188]: Received bad configure-rej:  12 06 00 00 00 00
  63
  64 To debug such problems, we can try adding `option pppd_optinos debug` to the interface config.  In the above case, it's a LCP CCP configure rej (the CCP options struct is exactly 6 octets in size as indicated in source code `pppd/ccp.h`) and since the internet fee is not charged on the bytes transferred, I will just use `noccp` to disable the negotiation altogether.
  65
  66 Also to optimize bulk transfer performance, you can try tweaking the ciphers.  OpenSSH client does not support `none` cipher by default and you have to patch and install it for by yourself.  Another option is to try ciphers like `arcfour` and `blowfish-cbc`.  In my case, `arcfour` has the best throughput.
  67
  68         option ssh_options '-o "Ciphers arcfour"'