Mallet - a TCP tunnel like VPN

I've developed a TCP tunnel, called "Mallet", that works like VPN. It depends on jpillora/chisel for TCP tunneling.
You just need to run a chisel server in a machine that you would like to get traffic through.

Mallet configures iptables (Linux) or pf (macOS) to redirect traffic to the TCP tunnel.

Features

• No admin privilege required in a server. You just need SSH as a normal user.
  • You still need sudo right in a client machine to redirect traffic.
• Encrypted connection (thanks to chisel)
• Performant (thanks to chisel)

Installation

https://github.com/ryotarai/mallet#installation

Usage

Assume that you have a server a.example.com and would like to get traffic to 10.0.0.0/8 through a.example.com:

Laptop --> a.example.com --> 10.0.0.0/8

First, install chisel to a.example.com by following https://github.com/jpillora/chisel#install and run chisel server:

a.example.com$ chisel server --port 8080

(Keep this chisel process running)

Then, run Mallet and connect to the chisel server:

$ sudo mallet start --chisel-server http://a.example.com:8080 10.0.0.0/8

(Keep this mallet process running)

Now, all TCP traffic to 10.0.0.0/8 is forwarded via a.example.com.

Usage with SSH

In this example, we will run Mallet via SSH port forwarding.

Assume that you have a server a.example.com and would like to get traffic to 10.0.0.0/8 through a.example.com:

Laptop --SSH--> a.example.com --> 10.0.0.0/8

First, install chisel to a.example.com by following https://github.com/jpillora/chisel#install

Second, launch chisel server on a.example.com and forward a port to the server:

$ ssh -t -L 8080:127.0.0.1:8080 a.example.com chisel server --host 127.0.0.1 --port 8080

(Keep this ssh process running)

Then, start Mallet:

$ sudo mallet start --chisel-server http://127.0.0.1:8080 10.0.0.0/8

(Keep this mallet process running)

Now, all TCP traffic to 10.0.0.0/8 is forwarded via a.example.com.

Comparison

There is a similar project, sshuttle. sshuttle supports IPv6 and UDP, that Mallet does not support, however Mallet is more performant than sshuttle.

The following benchmark is measured by this method: https://github.com/ryotarai/mallet#benchmark

iperf benchmark

HTTP benchmark (wrk and nginx)

req/sec

avg latency