_ ReconLab
Commands  / Post-Exploitation  / sshuttle

sshuttle

Transparent VPN-over-SSH for pivoting.

KaliParrotLinuxlow

pkg: sshuttle

sshuttle routes subnets through an SSH host like a poor-man’s VPN — clean pivoting without proxychains.

Syntax

sshuttle -r {user}@{host} {subnet}

Example

sshuttle -r user@jump 10.10.10.0/24

Transparently routes the internal subnet through the SSH jump host.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-r <user@jump>Remote SSH host to tunnel through.
(subnet) <10.0.0.0/24>Subnet(s) to route through the tunnel.
--dnsAlso tunnel DNS queries.
-xExclude a subnet/host.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

sshuttle

Usage examples

sshuttle -r user@jump 10.10.10.0/24

Route an internal subnet through SSH.

sshuttle --dns -r user@jump 0/0

Tunnel everything incl. DNS.

Advantages
  • No client config/proxychains
  • Handles DNS, full TCP
Disadvantages
  • Needs SSH + Python on pivot
  • TCP/DNS only
Tags
#pivoting#ssh#tunnel

Official docs: sshuttle ↗

Related commands

Chisel

Fast TCP/UDP tunnel over HTTP/SSH.

Ligolo-ng

Fast tunneling/pivoting via a TUN interface.

proxychains

Force any TCP tool through a proxy chain.

Frequently asked questions

What is sshuttle used for?
sshuttle routes subnets through an SSH host like a poor-man’s VPN — clean pivoting without proxychains.
What is an example sshuttle command?
A common example is: sshuttle -r user@jump 10.10.10.0/24 — Transparently routes the internal subnet through the SSH jump host.
Is sshuttle part of Kali Linux?
Yes. sshuttle ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install sshuttle.
What category of security tool is sshuttle?
sshuttle is a Post-Exploitation tool with a low-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →