Sshuttle 1.1.1 not working on macOS Sonoma 14.1.1
jadsonjs opened this issue · comments
Sorry if this is a duplicate issue, but I could not find another issue with the same problem. I am trying to use Sshuttle for the first time to connect to a Linux server from my macOS. With the command below:
sshuttle -v -r user@XXX.XX.XX.XX:YYYY -x XXX.XX.XXX.XX XXX.0.0.0/8 XXX.XXX.X.0/24
When running this command, after typing the password, the flow lines of logs are shown:
s: Running server on remote host with /usr/bin/python3 (version 3.10.6)
s: latency control setting = True
s: auto-nets:False
c : Connected to server.
fw: setting up.
fw: >> pfctl -s Interfaces -i lo -v
fw: >> pfctl -s all
fw: >> pfctl -a sshuttle6-12300 -f /dev/stdin
fw: >> pfctl -E
fw: >> pfctl -s Interfaces -i lo -v
fw: >> pfctl -s all
fw: >> pfctl -a sshuttle-12300 -f /dev/stdin
fw: >> pfctl -E
And it stays stopped in the last line (pfctl -E command), frozen, forever.
The pfctl -E command is used to enable the PF (Packet Filter) firewall on macOS
When I try to execute the command directly on my macOS terminal, the following lines are shown:
$pfctl -E
No ALTQ support in kernel
ALTQ related functions disabled
pf enabled
Token : 4235676552202453487
macOS Sonoma 14.1.1
shuttle --version 1.1.1
I checked the following issues, without any success:
I think this is a bug of sshuttle in macOS Sonoma. Can someone help me? Thanks
Same problem here. Everything worked before update
% sshuttle --dns -vr root@xxx 0/0
Starting sshuttle proxy (version 1.1.1).
c : Starting firewall manager with command: ['/Users/xxx/.pyenv/versions/3.11.5/envs/global3_11_5/bin/python3.11', '/Users/xxx/.pyenv/versions/global3_11_5/bin/sshuttle', '-v', '--method', 'auto', '--firewall']
fw: Starting firewall with Python version 3.11.5
fw: ready method name nft.
c : IPv6 enabled: Using default IPv6 listen address ::1
c : Method: nft
c : IPv4: on
c : IPv6: on
c : UDP : off (not available with nft method)
c : DNS : on
c : User: off (not available with nft method)
c : Subnets to forward through remote host (type, IP, cidr mask width, startPort, endPort):
c : (<AddressFamily.AF_INET: 2>, '0.0.0.0', 0, 0, 0)
c : Subnets to exclude from forwarding:
c : (<AddressFamily.AF_INET: 2>, '127.0.0.1', 32, 0, 0)
c : (<AddressFamily.AF_INET6: 30>, '::1', 128, 0, 0)
c : DNS requests normally directed at these servers will be redirected to remote:
c : (<AddressFamily.AF_INET: 2>, '8.8.8.8')
c : (<AddressFamily.AF_INET: 2>, '1.1.1.1')
c : (<AddressFamily.AF_INET: 2>, '4.4.2.2')
c : TCP redirector listening on ('::1', 12300, 0, 0).
c : TCP redirector listening on ('127.0.0.1', 12300).
c : DNS listening on ('::1', 12299, 0, 0).
c : DNS listening on ('127.0.0.1', 12299).
c : Starting client with Python version 3.11.5
c : Connecting to server...
s: Running server on remote host with /usr/bin/python3 (version 3.10.12)
s: latency control setting = True
s: auto-nets:False
c : Connected to server.
fw: setting up.
fw: nft add table inet sshuttle-ipv6-12300
Error: No such file add table
fw: undoing changes.
fw: nft delete table inet sshuttle-ipv6-12300
Error: No such file delete table
fw: error: ['nft', 'delete table', 'inet', 'sshuttle-ipv6-12300', ''] returned -13
fw: nft delete table inet sshuttle-ipv4-12300
Error: No such file delete table
fw: error: ['nft', 'delete table', 'inet', 'sshuttle-ipv4-12300', ''] returned -13
fw: fatal: ['nft', 'add table', 'inet', 'sshuttle-ipv6-12300', ''] returned 1
c : fatal: cleanup: ['/Users/xxx/.pyenv/versions/3.11.5/envs/global3_11_5/bin/python3.11', '/Users/xxx/.pyenv/versions/global3_11_5/bin/sshuttle', '-v', '--method', 'auto', '--firewall'] returned 99
Works fine with 1.1.1 on Sonoma 14.3
Contrary to to what is said by @andloh, I still have the issue in Sonoma 14.3 (version 14.3.1 (23D60)) with sshuttle v1.1.1 and v1.1.2 (available in brew) on Macbook Air M2 (SIP enabled; professionnal machine with Microsoft Defender for Endpoint, GlobalProtect+TunnelBlick) and Macbook Pro M2 Pro (SIP enabled; personal machine, no security software installed; Tailscale)
Didn't work on 14.2.2, I attempted to upgrade to 14.3.1 and it still does not work. Wonder if there is some other factor in play here. @andloh do you have your firewall enabled?
@skrobul Yes, I have firewall enabled, SIP too. Intel Mac
@andloh thanks, fwiw I'm on ARM based Mac so there is a difference here. Enabling/disabling firewall does not change a thing. SIP is enabled and I want to keep it that way.
Maybe it's some sort of endpoint protection software (i.e. Crowdstrike or Appgate SDP) blocking these?
sshuttle 1.1.1 on ARM M2 is OK for me. Firewall disabled. I did not change my SIP settings (=> enabled)
If you are using a VPN to connect see #563