Plugins: Add sslh as a service

[sjorge]

It would be nice to have sslh (http://www.rutschle.net/tech/sslh.shtml) as a service, or even as an option for a port forward rule. It's great to forward for example wan:443 to a ssh server, https server, openvpn server and something else (RDP for example)

Ofcourse you can use it on many ports, so having the option to configure multiple instances would be a must. (Hench the suggestion to have it under port forward as an option, it could then just spawn copies for each rule like you would with a proxy program)

[fichtner]

Should be a plugin. No ETA.

[fichtner]

This never popped up again, I'm closing this in favour of other issues.

[sjorge]

Hey @fichtner can the package be added to the opnsense repository? It is in the upstream freebsd one, that should help getting this as a plugin.

[sjorge]

Alright so I got the package installed via 'pkg add' from the freebsd repo...
Going to try another migration to opnsense with manual configure sslh, if it works well I should be able to look at this again.

[fichtner]

@sjorge 17.1.6 has the native package https://github.com/opnsense/tools/commit/4008167d

[sjorge]

Nice that will make it a bit easier, once everything is running smoothly with a manual config I'll look into turning it in a plugin. Some other bugs to get sorted before that though.

Back on topic, for those willing to play with this already:

myfw.vlan40 (LAN) -- Management VLAN
myfw.vlan30 (OPT1) -- Server VLAN

Interface | Port | Proto | Daemon
--------- | -----|-------|--------
IF_OPT1 | 443/tcp | inet4 | sslh
IF_OPT1 | 443/tcp | inet6 | sslh
IF_OPT1 | 1194/tcp | inet4 | OpenVPN server 1 (TCPv4)
IF_OPT1 | 1194/tcp | inet6 | OpenVPN server 2 (TCPv6)
IF_LAN | 22/tcp | inet4 | sshd
IF_LAN | 22/tcp | inet6 | sshd
IF_LAN | 443/tcp | inet4 | webgui (HTTPS)
IF_LAN | 443/tc[ | inet6 | webgui (HTTPS)

Technically the webgui also listens on IF_OPT1 443/tcp but because it lose loose binding sslh takes precedence because it binds 1x inet4 address and 1x inet6 address.

I also have a PortForward of IF_WAN 443/tcp inet4 -> IF_OPT1 443/tcp inet4, I also added my external domain name to the DNS_REBIND list for the WebGUI.

This means I can connect to port 443 (nearly all firewalls have it open) and access my firewall's WebGUI, I can ssh into the firewall (and use it as bastion host/sock proxy) or I can connect to it using OpenVPN.

Since all these things are encrypted most firewalls just let it pass through, this works great for in Hotels, Public WiFi, ...

/usr/local/etc/sslh.conf

# This is a basic configuration file that should provide
# sensible values for "standard" setup.

verbose: false;
foreground: false;
inetd: false;
numeric: true;
transparent: false;
timeout: 2;
user: "nobody";
pidfile: "/var/run/sslh.pid";


# Change hostname with your external address name.
listen:
(
    { host: "myfw.vlan30.example.org"; port: "443"; }
);

protocols:
(
     { name: "ssh";     host: "myfw.vlan40.example.org"; port: "22";   keepalive: true;               },
     { name: "openvpn"; host: "myfw.vlan30.example.org"; port: "1194";                                },
     { name: "tls";     host: "myfw.vlan40.example.org"; port: "443";  keepalive: true; log_level: 0; }
);

## install (upstream BSD)
pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/libconfig-1.4.9_1.txz 
pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/sslh-1.18.txz
## enable service
echo 'sslh_enable="YES"' > /etc/rc.conf.d/sslh

[dkowis]

Did it ever make it to a plugin?

[sjorge]

No, I couldn’t figure out the plugin stuff. I just install the package manually now and use it that way.

[mimugmail]

When you add a feature request in plugins repo I can add it next year, doesn't seem to be very complicated.

[fichtner]

Reopened in plugins

[Stan-Tastic]

I'll be glad to have it as well, I tried using HAProxy for multiplexing, but it's clearly not made for this. SSLH on my previous Linux router was working flawlessly.