$./vpn

A shell is not a VPN product.

Run WireGuard from the account. That is allowed. We have the resources. It is still a Linux login, not a VPN SKU. Login remains ssh user@kire.net. Hostnames and addresses come with laughs when they reverse resolve.

What this page is. An honest comparison: SSH tunnel vs SOCKS vs WireGuard on a multi-tenant shell. A minimal one-peer mental model. Config shapes. Limits we will not paper over.

Who it is for. You already have a shell and a reason a port forward cannot do the job. If the reason is “I want a commercial VPN,” buy a commercial VPN. If the reason is “cafe Wi-Fi hates IRC,” start with ./ssh-forwarding and -D.

$why-a-kire-shell

Always-on, DDoS in front, ident and vhost already handled. The lid on your laptop is still not infrastructure. None of that turns the account into an exit node for the neighborhood.

$cheat-sheet

tool	what it is	when to use it
SSH `-L`	one TCP port through the session	one service, one job
SSH `-D`	SOCKS, apps opt in	browser, IRC client that speaks SOCKS
SSH TUN / `-w`	layer-3 via SSH	rarely. TCP-over-TCP. pain
TLS proxy	wrap or terminate one port	./proxies
WireGuard	UDP overlay, AllowedIPs is the policy	when you actually need a net, not just SOCKS
userspace VPN	no kernel module, more CPU	if kernel WG is not there. be polite on a shared box

$for-beginners

SSH -L moves one port. SSH -D is a SOCKS proxy: each app chooses to use it. WireGuard is a point-to-point (or hub-and-spoke) UDP tunnel with a cryptokey routing table. AllowedIPs is that table. Think “one peer, one /32” before you think “full tunnel 0.0.0.0/0.”

A tunnel is enough when the client can speak SOCKS or you only needed one port. Full-tunnel VPN is how you black-hole the SSH session you used to bring the VPN up. That is funny once.

Kernel WireGuard needs a module and usually privileges a shared shell does not give you. We do not promise CAP_NET_ADMIN. We do not promise modprobe wireguard. Userspace implementations exist and will burn more CPU. On a multi-tenant box that is a courtesy issue, not a flex.

Check the AUP and ask staff before this becomes an exit node, a family VPN, or a bandwidth story. No unlimited-bandwidth VPN. No “I pointed the whole house at it.”

$for-people-who-already-know-the-flags

If wg / wg-quick are not there, stop. Compile in $HOME only if you already know you are allowed to create a tun device. Placeholder addresses below are examples, not an allocation.

Shell as the “server” peer

# /home/user/wg0.conf  — example only
[Interface]
Address = 10.13.37.1/24
ListenPort = 51820
PrivateKey = SHELL_PRIVATE_KEY
# MTU = 1280

[Peer]
PublicKey = LAPTOP_PUBLIC_KEY
AllowedIPs = 10.13.37.2/32

Laptop as the client peer

[Interface]
Address = 10.13.37.2/24
PrivateKey = LAPTOP_PRIVATE_KEY
# DNS = ...   # set it on purpose or not at all

[Peer]
PublicKey = SHELL_PUBLIC_KEY
Endpoint = shell.kire.net:51820
AllowedIPs = 10.13.37.1/32
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0, ::/0 is how you lose the SSH path to the endpoint unless you policy-route the shell’s real address outside the tunnel. Add a /32 (and /128) for kire.net / the assigned IP via ip rule / Table / FwMark before you bring the full tunnel up. If you do not know how, do not full-tunnel.

IPv6: either do it on purpose or leave it out. A half-enabled v6 path is a DNS leak with extra steps. DNS: if the tunnel is up and the stub resolver still talks to the cafe, you leaked. If it talks only through the tunnel, you had better still be able to SSH.

Keepalive 25s is the usual NAT charm. MTU: start conservative (1280) if things stall. ICMP black holes still exist.

Userspace vs kernel: kernel is cheaper. Userspace (wireguard-go, boringtun, etc.) will show up in top. Shared shell. Be boring. One peer. Small AllowedIPs. No transit for friends.

$dont

Public VPN exit. Neighborhood NAT. “My Discord friends hop through KIRE.” No.
Open proxy by another name. Mining. Scanners. Services you do not own.
Assuming root, modules, or CAP_NET_ADMIN.
Full-tunnel without a bypass for the SSH endpoint.

If this paragraph surprised you, use SSH -D and go outside.

$smaller-tool

SSH tunnel · TCP/SSL proxy · WireGuard. Smallest tool that solves the job. That is usually not WireGuard.

client area order a shell ask a human