xiringuito
A lightweight SSH-based VPN alternative that creates secure tunnels to remote networks without requiring a dedicated VPN server.
What is xiringuito?
xiringuito is an SSH-based network tunneling tool that creates secure connections to remote networks without requiring a dedicated VPN server. It uses SSH's built-in capabilities to route traffic through tun/tap devices, supporting various protocols including TCP, UDP, and low-level IP traffic. The tool solves the problem of quickly accessing internal networks when only SSH access is available, eliminating the need for complex VPN configurations.
System administrators, DevOps engineers, and network professionals who need temporary, secure access to remote subnets via SSH, especially in environments where traditional VPNs are impractical or overkill.
Developers choose xiringuito for its simplicity, lack of dependencies (no Python required), and ability to handle non-standard protocols like RTP and OSPF. It offers a lightweight, scriptable alternative to tools like sshuttle, with minimal setup and transparent operation through tun/tap interfaces.
Overview
SSH-based "VPN for poors"
Use Cases
Best For
- Quickly accessing internal corporate networks from outside via SSH
- Tunneling UDP-based protocols like RTP for media streaming
- Testing low-level IP protocols (OSPF, IPSec) over SSH connections
- Creating temporary VPN-like connections without server configuration
- Managing multiple simultaneous tunnels to different remote networks
- Automating route discovery for dynamic cloud environments like AWS VPCs
Not Ideal For
- Environments where passwordless sudo is not available on the SSH server
- Mac users unwilling to install third-party kernel extensions like TunTap
- Production systems requiring long-term, stable VPN connections with formal support
- Teams that prefer Python-based tools or have extensive sshuttle integrations
Pros & Cons
Pros
Just specify an SSH server and target networks; no VPN server setup or configuration files are needed, as shown in the one-line command example.
Uses tun/tap devices to support TCP, UDP, and low-level IP protocols like RTP and OSPF, which the README highlights as a key advantage over sshuttle.
Allows custom scripts for dynamic route discovery, such as the AWS example that automatically fetches VPC subnets, reducing manual input.
Can run multiple simultaneous tunnels as long as routes don't overlap, enabling access to disparate networks through different SSH servers.
Cons
Requires local and remote sudo privileges; without passwordless sudo, manual password entry is needed for each connection, breaking automation as noted in the server-side sudo note.
Mac users must install TunTap separately, adding an extra step and potential compatibility hurdles, which the README explicitly warns about.
Written in Bash, it may have performance and robustness concerns; the README admits a future rewrite in a statically typed language is needed for major improvements.
Frequently Asked Questions
Related Projects
BatA cat(1) clone with wings.
btopA monitor of resources
exaA modern replacement for ‘ls’.
goaccessGoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.