{"slug": "sshuttle", "name": "sshuttle", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.916, "rising": -0.98, "first": "2025-12-29", "latest": "2026-06-25", "why": "it magically solves a bunch of these problems without constant reconfiguration", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 1, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "it magically solves a bunch of these problems without constant reconfiguration", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/sshuttle/sshuttle", "official_url": "https://github.com/sshuttle/sshuttle", "pricing": "", "aliases": ["sshuttle"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 778776448, "item_id": 48673528, "url": "https://news.ycombinator.com/item?id=48673528", "by": "hansvs", "date": "2026-06-25", "version": null, "stance": "recommend", "quote": "Yup, use it regularly in order to jump through networks where a VPN/Wireguard setup is not possible", "excerpt": "Yup, use it regularly in order to jump through networks where a VPN/Wireguard setup is not possible. It can also forward DNS requests and handle local NS operations reasonably well, such that it can be used as a low-key split-VPN client (i.e. only forwards traffic for a specific domain or IP range without redirecting any other traffic). Note that for integration with `systemd-resolved`, one needs to jump through a fe", "context": "", "use_case": "Split-VPN over SSH", "switched_from": "", "story": "A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding"}, {"id": 778587712, "item_id": 48661732, "url": "https://news.ycombinator.com/item?id=48661732", "by": "smw", "date": "2026-06-24", "version": null, "stance": "recommend", "quote": "it magically solves a bunch of these problems without constant reconfiguration", "excerpt": "Need to mention sshuttle [0] here, as it magically solves a bunch of these problems without constant reconfiguration [0] https://github.com/sshuttle/sshuttle", "context": "", "use_case": "SSH-based tunneling/VPN", "switched_from": "", "story": "A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding"}, {"id": 742864944, "item_id": 46429059, "url": "https://news.ycombinator.com/item?id=46429059", "by": "dlenski", "date": "2025-12-29", "version": null, "stance": "recommend", "quote": "I've used it for many years.", "excerpt": "> I expect it won't be long until someone deploys the first proxy service that handles the initial CONNECT payload in the kernel before offloading packet forwarding to an eBPF script that will proxy packets between hosts at layer 3, making this fingerprinting technique obsolete. https://github.com/sshuttle/sshuttle basically works like this. I've used it for many years. I don't think it'll be possible to detect using", "context": "", "use_case": "Transparent SSH VPN tunnel", "switched_from": "", "story": null}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["split-vpn over ssh", "ssh-based tunneling/vpn", "transparent ssh vpn tunnel"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48606222", "title": "A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46386878", "title": "item 46386878", "mentions": 2}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 2}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 778776448, "item_id": 48673528, "url": "https://news.ycombinator.com/item?id=48673528", "by": "hansvs", "date": "2026-06-25", "version": null, "stance": "recommend", "quote": "Yup, use it regularly in order to jump through networks where a VPN/Wireguard setup is not possible", "excerpt": "Yup, use it regularly in order to jump through networks where a VPN/Wireguard setup is not possible. It can also forward DNS requests and handle local NS operations reasonably well, such that it can be used as a low-key split-VPN client (i.e. only forwards traffic for a specific domain or IP range without redirecting any other traffic). Note that for integration with `systemd-resolved`, one needs to jump through a fe", "context": "", "use_case": "Split-VPN over SSH", "switched_from": "", "story": "A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding"}, {"id": 778587712, "item_id": 48661732, "url": "https://news.ycombinator.com/item?id=48661732", "by": "smw", "date": "2026-06-24", "version": null, "stance": "recommend", "quote": "it magically solves a bunch of these problems without constant reconfiguration", "excerpt": "Need to mention sshuttle [0] here, as it magically solves a bunch of these problems without constant reconfiguration [0] https://github.com/sshuttle/sshuttle", "context": "", "use_case": "SSH-based tunneling/VPN", "switched_from": "", "story": "A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding"}, {"id": 743836304, "item_id": 46489769, "url": "https://news.ycombinator.com/item?id=46489769", "by": "benmmurphy", "date": "2026-01-04", "version": null, "stance": "neutral", "quote": "sshuttle as described sounds like a normal CONNECT proxy which this is able to detect", "excerpt": "sshuttle as described sounds like a normal CONNECT proxy which this is able to detect: https://sshuttle.readthedocs.io/en/stable/how-it-works.html like its similar to connect or socks proxy except it is using SSH as a transport layer instead of TCP as a transport layer and its doing it transparently without having applications to be written to use the proxy. but if you are just converting TCP packets into a datastrea", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 742864944, "item_id": 46429059, "url": "https://news.ycombinator.com/item?id=46429059", "by": "dlenski", "date": "2025-12-29", "version": null, "stance": "recommend", "quote": "I've used it for many years.", "excerpt": "> I expect it won't be long until someone deploys the first proxy service that handles the initial CONNECT payload in the kernel before offloading packet forwarding to an eBPF script that will proxy packets between hosts at layer 3, making this fingerprinting technique obsolete. https://github.com/sshuttle/sshuttle basically works like this. I've used it for many years. I don't think it'll be possible to detect using", "context": "", "use_case": "Transparent SSH VPN tunnel", "switched_from": "", "story": null}]}