I think I have this set up right, but I'd appreciate a sanity-check and any info on best practices that I should be using for creating SSH tunnels to my home network while traveling.

Home network: Router with ssh enabled (key only) and a random port forwarded to the router port 22. Behind the router (without forwarded ports) are all of my local 192.168.... addresses.

Travel computer: Chromebook with Secure Shell extension, set up to ssh user@domain -D port, ed25519 key. Proxy SwitchyOmega extension set to auto-switch to the tunnel for specified addresses when connected via ssh.

Now, when I connect, my understanding is:

  1. The ssh connection to the router is encrypted, i.e. the ssh results in a terminal shell on the router and everything I do there is secure from anyone without access to the travel computer or home router.
  2. In the browser of my travel computer, if I go to one of the tunneled addresses, SwitchyOmega sends all of the data through the ssh tunnel in #1, encrypting everything between the travel laptop and the router.
  3. If the tunneled address itself uses encryption, e.g. https, that passes inside the tunnel between the laptop and router encrypted by ssh as well, and continues on from the router still encrypted using https.
  4. If the tunneled address doesn't use encryption, e.g. http, that passes inside the tunnel (and is therefore encrypted by ssh between the laptop and router), but once it leaves the router it continues on as plain (unencrypted) http.
  5. If the tunneled address is inside my home network and isn't encrypted, e.g. http 192.168..., the unencrypted part of the path occurs entirely behind my home network router, and is protected by the firewall from anyone without access to my home network already.

I think that means that an attacker without access to either ssh endpoint (laptop or home network) should not be able to read the communication between my devices - and that's true even if the device on the home network is using unencrypted http and the travel computer on public/untrusted wifi. Is that right? Are there any gaps in that setup that would leave unencrypted data exposed?

Is there anything else I should be doing/not doing? Thanks!

  • 1
    Your understanding is correct. Your setup is simple and solid.
    – ThoriumBR
    Jul 6 '21 at 4:47
  • Great, thank you! Jul 6 '21 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.