The content of this topic has been archived on 14 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.
I've successfully flashed my WRT54GL 1.1 to OpenWrt and I've got a bridge (wl0_mode=sta) set up to a communal AP. What I would like to do is tunnel all of my traffic, to make sure the other people using the AP can't sniff my traffic. I have a server at a remote facility running openssh which I can connect to, and from there the internet at large.
My question is, how do I use the ssh command in OpenWrt to tunnel ALL traffic from the router to the remote server?
Diagram:
Your question isn't 100% clear to me.
Do you want to have all of your subnet able to access the ssh tunnel? Is "my subnet" trusted?
So, I'll make some assumptions and tell you what I think you need to do at a high level.
1.) You are going to have to tweak "my server" sshd configuration to allow non local forwarding.
2.) Set up your router to automatically connect ssh to "my server" and have ssh act as a socks proxy.
You will need to use something like this:
ssh -D 8080 user@myserver
Since ssh doesn't allow command line passwords, you will need to set up an "identity file" on your "router" and set it up as trusted on "my server".
3.) Your clients should use socks compatible software that points to "bind_address" on the specified port.
4.) If you want to be paranoid, you can set up a filter in your firewall config to block traffic from "my subnet" that doesn't use the proxy and attempts to directly use the internet.
I'm not aware of any way that you can set this up as a transparent VPN type setup.
perfect! that's exactly what I was after.
I would have gone an entirely different route. Probably setup a routed AP-client mode, so my local WRT unit is picking up signal and treating that like a WAN connection. So all local traffic is a separate NAT nework.
Then use OpenVPN to establish a tunnel to the remote server. This depends on you having admin access on the other end to setup OpenVPN, and the knowledge to run it. Not by my standards terribly difficult, as I have done setups very similar to what I describe. I am using OpenVPN now to link remote sites. But not something I can really write a howto on either.
OpenVPN is probably a better solution. I haven't ever set that up before, so I can't give you any tips.
The discussion might have continued from here.