How to configure SSH to connect through an OpenVPN?

Question

I have a desktop at work that I like to keep synchronized with my home computers using Unison, which connects through SSH. I also sometimes like to remote in to the work computer using SSH.

My work network is starting a new policy that will only allow connections from outside the network if they are over a VPN.

Is there a way that I can adjust my SSH configuration so that whenever it tries to log in to the work computer, it goes through the work VPN?

To be clear, I do not want to have to manually connect to the work VPN each time I want SSH to connect to the work computer. I also do not want to be permanently connected to the work VPN.

Note that I can freely change both the client (my home computers) and server (work computer) SSH configurations. Also, I don't think it should matter, but all machines in question are Linux boxes. I am using OpenSSH and the work VPN is openVPN.

Clarification: The main reason I want to not be permanently connected to the work VPN is to not have to worry about following their terms of service. So I want only the SSH traffic to be sent through the VPN and nothing else.

Solution

Several options come to my mind.

Shell Script

you could write a shell script which

• starts openVPN
• starts SSH

• stops openVPN when SSH disconnects

  #!/bin/bash /usr/bin/openvpn /home/user/ovpn/config.ovpn ssh user@host pkill -SIGTERM -f 'openvpn --conf /home/user/ovpn/config.ovpn'

After that, you can alias that, e.g. alias vpnssh='/home/scriptname.sh', and/or add that to your .bashrc.

Proxycommand

You can try to use openSSH's proxycommandfor that:

ssh -o ProxyCommand="/usr/bin/openvpn /home/user/ovpn/config.ovpn" user@host

in both cases

you need to tell openVPN that you do not want to route everything through the tunnel. So, given that 192.168.0.1 is your work desktop, add the following to your openVPN config file

route-nopull route 192.168.0.1 255.255.255.255

use route 192.168.0.0 255.255.255.0 if you want to reach the whole subnet.

Comments

[evencoil]

Are these solutions going to make my entire connection go through the VPN? I don't want that to happen because I don't want to be subject to my work's terms of service.

[stueja]

Ah, I'm sorry, I literally knew that I forgot something. Thanks for the reminder. I will update my answer accordingly.