> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/pivoting-port-forwarding/vpn-tunneling-using-ssh.md).

# VPN Tunneling Using (SSH)

VPN tunneling establishes a communication channel between two endpoints over an insecure network. SSH-based VPN tunnels are commonly used to pivot or route traffic from internal machines to an external system (e.g., an attacker's box).

{% hint style="danger" %}
To create a VPN tunnel using SSH, root-level access or permission to modify SSH configurations and create tunnel interfaces (`tun`) is required.
{% endhint %}

***

### **Prerequisites**

* SSH access with root privileges on the target machine.
* Ability to edit and restart the SSH daemon on the target.

***

In this setup, the attacker initiates a tunnel from their system to a target device running an SSH server.

#### SSH into the target machine:

```bash
ssh root@<target_IP>
```

#### Enable tunneling in the SSH configuration on the **target**:

Edit `/etc/ssh/sshd_config` and set:

```
PermitTunnel yes
```

#### Restart SSH service on the **target**:

```bash
systemctl restart sshd
```

#### On the **attacker** machine, initiate the SSH tunnel:

```bash
ssh -w 0:0 root@<target_IP>
```

This creates `tun0` interface on both systems.

#### Configure the `tun0` interface on the **target**:

```bash
ip addr add 10.0.0.2/24 peer 10.0.0.1 dev tun0
ifconfig tun0 up
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.0.0.1 -o <interface> -j MASQUERADE
```

#### Configure the `tun0` interface on the **attacker**:

```bash
ip addr add 10.0.0.1/24 peer 10.0.0.2 dev tun0
ifconfig tun0 up
route add -net <internal_target_network>/<subnet> gw 10.0.0.2
```