Bypass Palo Alto company firewall reddit / selfhosted ---------------------------------------------------------------------- martijn79 · 2023-10-19 09:03 Hello, My company is using a palo alto firewall which replaces the SSL certificate for every HTTPS site by a company generated one. I used to bypass internet filtering by creating a SSH tunnel with Putty (I am local admin and can run Putty on my laptop) and run it on port 443. Then add a socks proxy in my browser setting and I was done. No more SSL filtering and I could access any website. But now the firewall is blocking this as well. SSH to port 443 is not working anymore. I tried this: [https://hacktr.org/blog/2020/01/01/ssh-tunneling-over- https/](https://hacktr.org/blog/2020/01/01/ssh-tunneling-over-https/) but it didn't work either. I also tried this: [https://mariobrandt.de/archives/technik/ssh- tunnel-bypassing-transparent-proxy-using- apache-170/](https://mariobrandt.de/archives/technik/ssh-tunnel- bypassing-transparent-proxy-using-apache-170/) But no go as well. This has to be possible some way, by proxying apache to SSH using a letsencrypt cert. I tried to add a LE cert but the problem is when apache proxies to SSH it changes to IP ad the firewall blocks that step. Any idea how to solve this? ​ ​ ---------------------------------------------------------------------- thekrautboy · 2023-10-19 09:10 You wont like to hear this but: **Dont do this**. Do not try to circumvent protections that company IT has put in place. You will find yourself in a meeting with IT and HR much quicker than you think. You have 3 options: * Stop doing what youre trying to do * Talk to IT and see if they would make exceptions for you * Keep attempting this and risk losing your job You might want to bookmark a sub like /r/LegalAdvice for the future, good luck! /r/SysAdmin and /r/CyberSecurityAdvice can probably also tell you to stop doing this. ---------------------------------------------------------------------- martijn79 · 2023-10-19 09:14 I know the network guy I can easily ask him to make an exception (I'm a sysadmin here). But it's more fun to try and bypass it. They really don't mind, I've bypassed it before and they all knew. But thanks for the moral speech anyway. I really hope not all comments will be like this. ---------------------------------------------------------------------- mrkesu · 2023-10-19 09:16 This has nothing to do with selfhosting, this is a 100% security/hacker related question. ---------------------------------------------------------------------- thekrautboy · 2023-10-19 09:19 > I know the network guy > They really don't mind, I've bypassed it before and they all knew Better get that in writing. > But thanks for the moral speech anyway. Youre welcome! > I really hope not all comments will be like this. I really hope they are. And still, this is the wrong sub. ---------------------------------------------------------------------- Brent_the_constraint · 2023-10-19 09:25 I really hope you get a warning for the behaviour... you are endangering the company and explicity circumvent policies.... this is not OK. Do this on your own equipment, not behind a company firewall. ---------------------------------------------------------------------- TryHardEggplant · 2023-10-19 09:27 Any professional will tell you to just follow company policy on company networks and company devices. And if you get an exception, to get it in writing and saving a hard copy. Don’t trust the word of anyone. It shouldn’t be “fun” to risk losing job unless it is your job to pentest. But then why are you asking here? ---------------------------------------------------------------------- thekrautboy · 2023-10-19 09:28 *But Jeff in IT said its fine!* ---------------------------------------------------------------------- lilolalu · 2023-10-19 09:31 When I was working in companies with very restricted firewalls and needed to access my homeserver via SSH, I was using TOR browser (which exists as portable versions so you need to install anything which you are not allowed to). TOR Browser creates a socks proxy, which you can then use from kitty/putty ssh to dial out. ---------------------------------------------------------------------- Brent_the_constraint · 2023-10-19 09:40 The Problem is: it´s funny how regular people think they know better than IT.. Everyone responsible for any kind of medium to large size company IT will have physical pain when reading OP's statement/question. We invest huge money and time to try to get the company to survive the "inevitable" of been hacked and the chance of this incident bringing down the company and people loosing their job is unbelivable. And then there are specialists like OP that intentially poke holes into all of this and even do this using an Admin account where a donkey would know that nothing is easier to take over a company then starting off with a local admin on a workstation. Most IT departments that have conducted any white hat hacking tests have realised that it is way way harder for an attacker to be successfull if there is no simple way to aquire admin privileges. Having this access level to begin with means most next steps are so much easier... And this is the reason why especially R&D people (which I assume the OP is) must be restricted as the usually need some more priviledges for their work but this kind of behaviour is what get´s you fired in a proper company. As OP stated: their IT knows and does not care.... good luck. ---------------------------------------------------------------------- AdrianTeri · 2023-10-19 09:41 Stop trying to access non-related work things on corporate networks! Use you own travelling router/mobile tethering etc If you're abusing this policy also know anything you do/create on "their" computers is/can be visible to them and in the case of creation they can claim IP! ---------------------------------------------------------------------- lilolalu · 2023-10-19 09:41 https://tb-manual.torproject.org/circumvention/ ---------------------------------------------------------------------- AdrianTeri · 2023-10-19 09:46 If it's your company you can do as you wish.... You're a wage earner/worker you either follow rules or get max 3 warnings and/or get fired for cause! ---------------------------------------------------------------------- darkager · 2023-10-19 09:47 I do a lot of cloud identity/security work and I just shake my head. It's in your best interest to establish a boundary now that work resources are *work resources*, not yours. You will save yourself many a headache throughout your career. You don't want to be the one whose identity was compromised by your carelessness. ---------------------------------------------------------------------- lilolalu · 2023-10-19 09:51 Look. The world is big. There are different countries with different culture. Also different work culture. The average German company will not kick you out because you tray to access your server. Sorry if it's different for you. ---------------------------------------------------------------------- PolicyArtistic8545 · 2023-10-19 09:51 > it’s more fun to try and bypass it Pretty sure that’s a crime since you don’t have authorization. It’s not in your official capacity to bypass security controls. ---------------------------------------------------------------------- rg080987 · 2023-10-19 09:55 You shouldn't be handling your personnal work on the work machine. Who knows they kight have other tools installed as well to monitor the activity. ---------------------------------------------------------------------- thekrautboy · 2023-10-19 09:58 Fyi the "max 3 warnings" thing is mostly a myth. It depends on the exact nature of each incident, you could get fired after 1 warning, or after 5. And also it depends a lot on local laws, obviously. ---------------------------------------------------------------------- stayupthetree · 2023-10-19 09:58 "which exists as portable versions so you don't need to install anything which you are not allowed to" No. Running an unauthorized executable whether "portable" or "installed" is likely against policy lol ---------------------------------------------------------------------- xXxoraAa · 2023-10-19 09:59 Tunnel ssh over http! As long as your remote web server is not blocked it will work! ---------------------------------------------------------------------- lilolalu · 2023-10-19 10:03 So why do people feel it is their job to educate others without being asked to? I really enjoy that we live in the freedom to do stuff we are not supposed to, or not allowed to. It's a valid approach to warn someone, I.e. if OP wouldn't know what he is doing. I think he knows and is fully aware of potential consequences so why does everyone think they are smarter than him? ---------------------------------------------------------------------- Dizzybro · 2023-10-19 10:07 /r/shittysysadmin ---------------------------------------------------------------------- sneakpeekbot · 2023-10-19 10:07 Here's a sneak peek of /r/ShittySysadmin using the [top posts](https://np.reddit.com/r/ShittySysadmin/top/?sort=top&t=year) of the year! \#1: [One of us](https://i.redd.it/ek4g8qf7bglb1.jpg) | [82 comments]( https://np.reddit.com/r/ShittySysadmin/comments/166bslb/one_of_us/) \#2: [I cut Internet to a whole building today by turning on a server. ](https://np.reddit.com/r/ShittySysadmin/comments/16dok66/i_cut_intern et_to_a_whole_building_today_by/) \#3: [Didn't find any porn](https://np.reddit.com/r/ShittySysadmin/com ments/15p26i8/didnt_find_any_porn/) ---- ^^I'm ^^a ^^bot, ^^beep ^^boop ^^| ^^Downvote ^^to ^^remove ^^| ^^[Contact](https://www.reddit.com/message/compose/?to=sneakpeekbot) ^^| ^^[Info](https://np.reddit.com/r/sneakpeekbot/) ^^| ^^[Opt-out](ht tps://np.reddit.com/r/sneakpeekbot/comments/o8wk1r/blacklist_ix/) ^^| ^^[GitHub](https://github.com/ghnr/sneakpeekbot) ---------------------------------------------------------------------- sebampueromori · 2023-10-19 10:10 Big lmao, that company you work for has to be a joke ---------------------------------------------------------------------- thekrautboy · 2023-10-19 10:14 > I think he knows and is fully aware of potential consequences How did you decide that based on the initial OP alone? ---------------------------------------------------------------------- lilolalu · 2023-10-19 10:17 I assumed the 79 in his name is the birth year and if you are in your mid forties you should have learned that actions can have consequences. It might be a random number though. ---------------------------------------------------------------------- SicnarfRaxifras · 2023-10-19 10:18 But r/ShittySysadmin will welcome this with open arms ---------------------------------------------------------------------- leaflock7 · 2023-10-19 10:21 >I know the network guy I can easily ask him to make an exception (I'm a sysadmin here) so I have the solution for you. You and the network guys can easily make a profile just for you to not have this. What is a better solution than this since you and all the relevant people know about this? It is a 15-30 minute work max ---------------------------------------------------------------------- thekrautboy · 2023-10-19 10:24 Im older than that and i know nothing xD ---------------------------------------------------------------------- thekrautboy · 2023-10-19 10:25 Someone could crosspost it there... ---------------------------------------------------------------------- stayupthetree · 2023-10-19 10:33 Well when someone asks a question, like OP did, that would imply the seeking of knowledge. Beyond that, he posted on r/selfhosted asking how to bypass his company's security stack. I dont think we are smarter than him, but we are smart enough not to FAFO ---------------------------------------------------------------------- persiusone · 2023-10-19 10:49 First red flag your company is a joke: you have a local admin account. Seriously, do not circumvent your corporate security. You have literally zero defense to these actions and can be terminated immediately. Not if, but when it happens, you will also likely be blamed for any issues which arise even if they are not directly your fault. If you did have permission somehow to do this, I am not sure why you are asking for help on how to do this. If your company does allow this, it's even more of a joke than allowing a local admin account and that raises other questions. I allow my folks to BYOD on a (mostly) unrestricted BYOD/Guest network. Nobody has local admin accounts for any devices on the corp side. People can bring their personal laptops in and browse whatever and use VPNs on this network if they choose. There are some obvious restrictions (nothing illegal, for example), but if folks want to VPN to their self hosted environments or play on tiktok with their stuff, it's better for liability, better for security/compliance, and most importantly .. It is completely isolated from any corporate stuff. There is no need for circumventing when better options are available, promoting best practices for all employees. ---------------------------------------------------------------------- scorp123_CH · 2023-10-19 10:49 I've worked in a similar environment before ... Maybe my approach will work? **USE AT YOUR OWN RISK** But I used MacOS and Linux for this. Or more specifically: The OpenSSH clients and tools such as "nc" (BSD NetCat) these OS come with. The only way I ever managed to reproduce this on Windows 10 back then was via using CygWin ... Also: you'd need an OpenSSH server (BSD, Linux, MacOS ... these days Windows 10/11 would probably work too) somewhere somehow outside your company network, e.g. at home. I always used my own little Linux server at home for this. So what I write here is with OpenSSH and "nc" (BSD NetCat) in mind. Let's also assume that I want to access a remotely running RDP-server in my LAN (could be Windows, could be Linux via "xrdp" ... e.g. because I don't want my browsing history on my local company web browser ...) Thus: `ssh -p $REMOTESSHPORT -L 3389:192.168.1.39:3389 user@remote -o "ProxyCommand=nc -X connect -x proxy.hostname.net:$PROXYPORT %h %p"` => the RDP server (port 3389/tcp) running on my LAN host "[192.168.1.39](https://192.168.1.39)" becomes available as **"localhost:3389"** on my end, thanks to this SSH connection. And it will remain available for as long as this connection stays open. Filled with actual numbers and names this could look like this: `ssh -p 2243 -L 3389:192.168.1.39:3389 myuser@myhost.athome.ddns- domain.nu -o "ProxyCommand=nc -X connect -x clientproxy.corporation.net:8079 %h %p"` Why port "-p 2243" => my router at home is set to port-forward SSH from 2243 to 22; I don't use the standard port 22 on the outside because there are too many script-kiddies out there who otherwise keep hammering that port with login attempts... Not that I am worried (I do SSH-key based logins and not password-based logins ...) but I just find the flood of failed login attempts annoying. So I moved the SSH port to something above 1024. How this works: What happens here is that the "nc" tool will first pretend to be a standard SSL client (e.g. a web browser wishing to communicate via "https" ...) and connect to the corporate web proxy on the port the proxy expects ("8079/tcp" in my example) ... and then keep the connection open. And then the actual SSH connection goes through that tunnel and connects to my actual target host: my machine at home. In case you don't have an OS with BSD's flavour of "nc" (BSD NetCat) but something that uses e.g. Red Hat's "socat" instead: The syntax changes. `ssh -p 2243 -L 3389:192.168.1.39:3389 myuser@myhost.athome.ddns- domain.nu -o "ProxyCommand=socat - PROXY:clientproxy.corporation.net:%h:%p,proxyport=8079"` ... but it should work just the same. For as long as this SSH connection remains open the RDP-server running on the LAN host "192.168.1.39" becomes available as **"localhost:3389"** ... so you RDP into your LAN, you open your web browser at home, you can surf away as you want ... And your browsing history stays at home and unless you somehow activated some cloud-sync feature (... why oh why would you?) it should never ever end up on your work machine. Feel free to expand the number of ports (e.g. 5901 for VNC in addition to 3389 for RDP?). File-transfer protocols such as SFTP or "rsync" of course work too ... In case you downloaded something and need it transferred: `sftp -P2243 -o "ProxyCommand=nc -X connect -x clientproxy.corporation.net:8079 %h %p"` `myuser@myhost.athome.ddns- domain.nu` `rsync -av --progress -e ssh -p 2243 -o "ProxyCommand=nc -X connect -x clientproxy.corporation.net:8079 %h %p" 2>/dev/null myuser@myhost.athome.ddns- domain.nu:/path/to/remote/source/fileorfolder /local/path/to/destination/folder` ​ **Disclaimer: USE AT YOUR OWN RISK.** **In my experience in most places where they catch you doing this at work and without permission, they fire + sue you.** **Again: USE AT YOUR OWN RISK.** ---------------------------------------------------------------------- jkirkcaldy · 2023-10-19 11:00 Network guy may be fine with it, HR/Legal/CEO may not be. Company policies exist, and the network guy you’re a friend of may not have the sole authorisation to allow you do this. You’re on the fast track to get fired for doing shit like this. Just a reminder that company provided equipment is not yours. They own everything you do on the machine and your traffic is *their* traffic. If you want to browse the internet without their firewall, do it on your own device on your own internet connection. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-19 11:12 Trouble is many IT departments blindly purchase install whatever crap a security company recommends, without following step 2 (white listing). I’ve been blocked by these stupid filters from Amazon while in engineering having to order parts to get the equipment running because it was flagged as “Japanese porn” on the guest (contractor) network. And yes I resorted to a proxy/socks tunnel to my VPS. ---------------------------------------------------------------------- radakul · 2023-10-19 11:29 Stop trying to bypass their security. It exists for a reason and bypassing it is typically a fireable offense. Make nice with the IT guys and they might allow an exception, but try to circumvent them and you are bound to be more restricted, possibly losing local admin. ---------------------------------------------------------------------- MaxHedrome · 2023-10-19 12:02 OP... as an admin... you are the worst.... but since you're not my user 🤣 you'll probably have better luck tunnelling out on 53 masquerading as DNS with something like iodine. Btw, If I caught you doing this, because I block outbound DNS, I'd try to get you fired.