vpn_ssh.sh

#!/usr/bin/sudo sh

# Configure this
SSH_HOST="myhost.com.br"
SSH_PORT="2222"
###########
SSH_LOGIN="root" # ONLY root CAN SETUP TUNNELS :-(

#######################################################
# USUALLY, you don't need to configure this
IP_VPN_CLIENT="10.80.0.200"
IP_VPN_SERVER="10.80.0.100"

IFACE_VPN_CLIENT="tun0"
IFACE_VPN_SERVER="tun9"

#######################################################
# TRY TO DISCOVERY DEFAULT ROUTE
IP_GW=$( route -n | awk '/^0.0.0.0/ { print $2 }' )
IFACE_GW=$( route -n | awk '/^0.0.0.0/ { print $8 }' )

#######################################################
# SSH TO SERVER AND SETUP IT
SSH_HOST_IP=$( host -t A "$SSH_HOST" |awk '{print $4}' )
N_TUN_CL=$( echo "$IFACE_VPN_CLIENT" | perl -pe 's/\D+//' )
N_TUN_SR=$( echo "$IFACE_VPN_SERVER" | perl -pe 's/\D+//' )

ssh -f -w $N_TUN_CL:$N_TUN_SR "$SSH_LOGIN"@"$SSH_HOST_IP" -p"$SSH_PORT" "bash << END 
#!/bin/sh
# SERVER SETUP

# Setup interface
ip link set \"$IFACE_VPN_SERVER\" up
ip addr add \"$IP_VPN_SERVER\"/32 peer \"$IP_VPN_CLIENT\" dev \"$IFACE_VPN_SERVER\"

# enable ip forward
echo 1 > /proc/sys/net/ipv4/ip_forward

IFACE_GW=\$( route -n | awk '/^0.0.0.0/ { print \$8 }' )
# configure nat
iptables -t nat -L | grep \"$IP_VPN_CLIENT\" >/dev/null
if [ \"\\\$?\" != \"0\" ]; then
  iptables -t nat -I POSTROUTING -s \"$IP_VPN_CLIENT\" -o \"\\\$IFACE_GW\" -j MASQUERADE
  iptables -I FORWARD -d \"$IP_VPN_CLIENT\" -o \"$IFACE_VPN_SERVER\" -i \"\\\$IFACE_GW\" -j ACCEPT
  iptables -I FORWARD -s \"$IP_VPN_CLIENT\" -i \"$IFACE_VPN_SERVER\" -o \"\\\$IFACE_GW\" -j ACCEPT
fi
END
"
#######################################################

ip link set $IFACE_VPN_CLIENT up
ip addr add "$IP_VPN_CLIENT"/32 peer "$IP_VPN_SERVER" dev "$IFACE_VPN_CLIENT"
ip route add "$SSH_HOST_IP"/32 via "$IP_GW" dev "$IFACE_GW"
ip route replace default via "$IP_VPN_SERVER"

echo "VPN started"
echo "Press any key to stop it"

read l

pid=$( pgrep -f ssh\ -f\ -w\ $N_TUN_CL:$N_TUN_SR\ "$SSH_LOGIN"@"$SSH_HOST_IP"\ -p"$SSH_PORT"\ bash )
kill -9 "$pid"

ip route replace default via "$IP_GW" dev "$IFACE_GW"
ip route del "$SSH_HOST_IP"/32 via "$IP_GW" dev "$IFACE_GW"