SSH tunneling vs. OpenVPN

[revzalot]

I've setup both on my firewall. I find SSH tunneling more convenient than openvpn. So the question is which one is much safer when you're at a public hotspot doing online banking through your home network?

[BSDfan666]

It always depends on the circumstances.. obviously.

But look at it this way, OpenVPN is GPL and bloated.. OpenSSH is liberal and light.

Both support OSI level 2/3 tunnelling.. both utilize OpenSSL.

Pick the one you feel is right.

[revzalot]

OpenSSH is truly amazing due to its lightweight and ease of configuring.

[corey_james]

i'd use SSH over VPN any day!

I have no valid reasons, i just like ssh ^^

[s2scott]

<back after a long absence...>

the one potential disadvantage of SSH is that it is over TCP, not over UDP. As the transmission (e.g. 802.11) degrades the encryption correction/recovery compounds with TCP correction/recovery. Extra CPU cycles and some packets are spent/wasted.

This is only a problem on dirty/poor sessions.

In two years of operating this way, I've "suffered" it maybe two three times. openVPN or IPSEC would have suffered it better.

/S

[There0]

I too would have to go with OpenSSH tunneling, in fact I dropped OpenVPN tunneling in favour of implicit SSH tunnels instead about 4.3ish.

I do have a great howto with OpenBSD/OpenVPN/AuthPF if you really care to try (it's a bit dated), just tried uploading and could not, i can send them to you if you like, let me know.

[pik]

Originally Posted by There0

I do have a great howto with OpenBSD/OpenVPN/AuthPF if you really care to try (it's a bit dated), just tried uploading and could not, i can send them to you if you like, let me know.

Not sure about others, but I'm really keen to get a look at this guide if it's not too much trouble!

Cheers!

[windependence]

Originally Posted by s2scott

<back after a long absence...>

the one potential disadvantage of SSH is that it is over TCP, not over UDP. As the transmission (e.g. 802.11) degrades the encryption correction/recovery compounds with TCP correction/recovery. Extra CPU cycles and some packets are spent/wasted.

This is only a problem on dirty/poor sessions.

In two years of operating this way, I've "suffered" it maybe two three times. openVPN or IPSEC would have suffered it better.

/S

I dunno. I just set up OpenVPN for a local lumber company's sales force and we had to go to TCP because UDP wasn't stable enough. In this case I don't know how I would have implemented an ssh tunnel for them to access their desktop's without making it difficult for them. What would you guys have done in a situation like that?

-Tim

[Loki]

Originally Posted by windependence

I dunno. I just set up OpenVPN for a local lumber company's sales force and we had to go to TCP because UDP wasn't stable enough. In this case I don't know how I would have implemented an ssh tunnel for them to access their desktop's without making it difficult for them. What would you guys have done in a situation like that?

-Tim

http://sites.inka.de/~W1011/devel/tcp-tcp.html will give you an idea about why it isn't a good idea and will trigger some questions about why the TCP reliability didn't do the job as it is still TCP end-to-end in OpenVPN even when the tunnel is UDP.