tunnel interface names
dev at cyphermonks.org
dev at cyphermonks.org
Wed May 30 19:13:37 AEST 2018
>> the fact that ssh insists on tap* and tun* tun/tap-device-names is a
>> real nag and prevents from nice and easy solutions in some cases.
>
> Could you offer some examples?
some client:
ssh -o "Tunnel Ethernet" -w any office
next client:
ssh -o "Tunnel Ethernet" -w any office
...and so forth.
interface configuration on the hub for all clients:
allow-hotplug /tap*=tap
iface tap inet manual
bridge hub
now some other client needs a specific config on the server or there happens to be something else wanting to use a tap-interface for something else => every single client's interface has to be configured specifically, all interfaces have to be statically assigned to clients, clients have to reserve every single interface they might want to use in advance.
similar can be true for the client side:
ssh -b 1.2.3.4 -w any office
ssh -b 2.3.4.5 -w any office
allow-hotplug /tun*=tun
iface tun inet manual
up route add default dev "$IFACE"
will also soon have to end up with specific single-interfaces nondynamic config.
imagine mixing this: the office knows several bridges and possibly even other uses of tun/tap. might be the same for clients.
now tun/tap interfaces do not have to be named tun* or tap*. namespaces can be used. so:
clients:
ssh -o "Tunnel Ethernet" -w officebridge1:officebridge1-alice office-hub
on the hub:
allow-hotplug /officebridge1-*=officebridge1-port
iface officebridge1-port inet manual
bridge officebridge1
and
client:
ssh -b 1.2.3.4 -w office1:office-alice1 office
ssh -b 2.3.4.5 -w office2:office-alice2 office
allow-hotplug /office*=office
iface office inet manual
up route add default dev "$IFACE"
and server:
allow-hotplug /office-alice*=office-alice
iface office-alice inet manual
up route add 3.4.5.0/24 dev "$IFACE"
what is the point of artificially restricting names to just tun\d+ and tap\d+ ?
More information about the openssh-unix-dev
mailing list