# SSHuttle
**SSHuttle** creates a tunneled proxy that acts like a new interface, simulating a VPN, allowing us to route our traffic through the proxy without the use of[ proxychains](/post-exploitation/pivoting/tunneling.md#proxychains), all using ssh so the **connection is encrypted.**
{% hint style="info" %}
sshuttle only works on **Linux machines,** **python needs to be installed** (uploading a python binary is possible) AND **you need SSH access to the machine**
{% endhint %}
Open a tunnel using sshuttle
```bash
sshuttle -r username@address subnet
sshuttle -r user@172.16.0.5 172.16.0.0/24
```
Use **-N** to get sshuttle to automatically determine the subnets the machine is on using the servers routing table (doesn't always work).
```bash
sshuttle -r user@172.16.0.5 -N
```
Connect back using a key file
sshuttle -r user@172.16.0.5 --ssh-cmd "ssh -i private_key" 172.16.0.0/24
If the following error ever occurs we can get around it by excluding the compromised server out out the subnet we wish to forward to
```bash
client: Connected.
client_loop: send disconnect: Broken pipe
client: fatal: server died with error code 255
```
```bash
sshuttle -r user@172.16.0.5 172.16.0.0/24 -x 172.16.0.5
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://pnpt.adot8.com/post-exploitation/pivoting/sshuttle.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.