&gt; ssh -D (socks5 mode) doesn&#x27;t require root, and can forward both udp and tcp traffic<p>No, but it requires a SOCKS5 client, of which there aren&#x27;t many among software I use.<p>&gt; The trick lies in the &quot;kludgy tunnelling operations&quot; and the &quot;router&quot; (firewall rules)<p>The other important part of the magic is the packaging. While ssh+socks support is pretty common these days, it is not supported on e.g. dropbear (which is popular on routers).<p>sshuttle copies whatever it needs to the other side; as a result, there&#x27;s never an issue of version compatibility (which socks use sidesteps by virtue of using an old, cemented protocol). I have, in fact, needed to modify sshuttle with new options and features for a project, and I was not bound in any way by the existing protocol - whatever changes I made were always supported by the other end of the connection because the connection starts by copying them to the remote.<p>&gt;  I wonder how much effort it would be to get rid of some of the &quot;magic&quot;, though.<p>sshuttle is very well written; It is easy to tear it apart and rebuild it in other ways. But if you took the magic apart, you&#x27;d be left with a non-standard UDP-deficient SOCKS-alike system. Why would you want that?