Masking your traffic to penetrate very restrictive firewall reddit / selfhosted ---------------------------------------------------------------------- OundercoverO · 2023-11-02 16:01 Hello everyone, I happen to work at a place where there is a very restrictive firewall, and I would like some ideas as to how to circumvent that firewall. ​ From what I have gathered so far, it seems that: \- Everything other than basic ports (i.e. 22, 80 and 443) are blocked; \- UDP traffic seems to be subject to some sort of filtering mechanisms which I do not understand; \- SSH works fine for any external machine I have tested. ​ What I typically do is to setup a Wireguard tunnel by port-forwarding my router to my home server via some specific port. The server then acquires some local IP and all of my services are accessible through there. However, even when using the standard ports to establish a connection, the tunnel fails. ​ Given that non-standard ports are blocked, and UDP traffic seems to be constantly monitored, my idea was to masquerade my Wireguard traffic as either standard SSH or HTTP(s) traffic. For that, I was going to setup [UDP2RAW](https://github.com/wangyu-/udp2raw) on my laptop to convert Wireguard's UDP traffic to TCP, send that TCP traffic to my server via port 22, to pretend it's SSH traffic, in the server setup UDP2RAW to convert that TCP back to UDP and send it to the Wireguard interface. ​ My questions are: 1. Do you think this will work, or is there a better solution to my problem? 2. Is there anything that I can do to more thoroughly probe this firewall and find better ways of going around it? ---------------------------------------------------------------------- thekrautboy · 2023-11-02 16:21 > I happen to work at a place where there is a very restrictive firewall, and I would like some ideas as to how to circumvent that firewall. #Stop trying, dont do it. Youre not the first to ask for assistance with something like this here. Your employer has put these restrictions in place for a reason, if you keep trying to circumvent them, you will find yourself in a meeting with HR and IT very quickly. If you keep going down that route, bookmark /r/LegalAdvice now. Good luck! ---------------------------------------------------------------------- koffienl · 2023-11-02 16:21 What type of services are you trying to use? ---------------------------------------------------------------------- ithilelda · 2023-11-02 16:36 if the firewall has dpi, simply translating udp to tcp won't do. You'll also need to masquerade it as https traffic and use port 443. using port 22 for none ssh packets will definitely trigger dpi. However that's a hell lot of work to setup, and you're better off using a mature product. shadowsocks, v2ray, trojan, softether, just to name a few. we bypass the great firewall everyday to visit reddit anyway, so f**k legality👿. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-02 16:52 Just quit. Since you are not able to talk with your IT about it and they see everything you do. They will get rid of you if they A: See traffic going out from your Device to an unknown ip multiple times B: See Software running on your device C: know your reddit username D: you dont have a acceptable work/time Balance any they investigate further ---------------------------------------------------------------------- geo38 · 2023-11-02 16:56 When using some very restrictive public wifi, I have had success with this https://github.com/sshuttle/sshuttle It will set up a tunnel to pretty much any host reachable via ssh. ---------------------------------------------------------------------- kARATT · 2023-11-02 17:06 Saving this post in the ledger of reasons to enable deep packet inspection globally... Don't play around at work, these systems are in place for a reason. ---------------------------------------------------------------------- SamSausages · 2023-11-02 17:26 If it's their device and you are on their time, I wouldn't circumvent the systems that they put in place as a condition of your employment. ---------------------------------------------------------------------- Brent_the_constraint · 2023-11-02 17:56 Absolutely support this reply…. Just don‘t do it ---------------------------------------------------------------------- TryHardEggplant · 2023-11-02 18:04 Others have asked in r/sysadmin before, even recently, and have gotten the same response. ---------------------------------------------------------------------- Stuntz · 2023-11-02 18:45 Upgrade your phone plan to unlimited and use mobile data to access your shit. End of story. ---------------------------------------------------------------------- ismaelgokufox · 2023-11-02 18:59 This guy 🙃. ---------------------------------------------------------------------- FuriousRageSE · 2023-11-02 19:04 >Your employer has put these restrictions in place for a reason, if you keep trying to circumvent them, you will find yourself in a meeting with HR and IT very quickly. They should do less "stupid settings" that i NEED to change. I DON'T NEED my computer to go to sleep as soon i turn my back to it. i NEED to have my browser to open and start off where i left it (as in keep ALL tabs etc). i NEED adblock extension, which is blocked, well 99% of extensions are blocked. i DON'T need forced reboots, i for sure shutdown my computer the end of the week, updates can run then. This is just what i remember on top of my head. i CAN understand that the start page/home button opens the company intranet, but 99/99.5 people does NOT need to be forced to the intranet, since most dont read in there and are mostly useless for the daily work flow, i only need the intranet when i need to lookup some information i need to know (or want to). i NEED local admin on my laptop, many of my software hardly works in non-admin run. i NEED that my softwares update check software being able to connect and look for updates for the software i NEED for my work, Siemens TIA Portal update server is 100% blocked, so instead of looking for a <=1GB update, i must download a 5+ GB installer to get those few files the updater could have downloaded and installed for me. On my "old work laptop" (i dual run 2 laptops for about the next year or so), some installers put some short cuts into the PUBLIC user folder, its so locked down, the installers that tries write to this folder(or subfolders in the c:\\users\\public\\) they just fail. ---------------------------------------------------------------------- thekrautboy · 2023-11-02 19:23 Cant tell if sarcasm or just insane. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-02 19:25 OP I am a network engineer by trade, we can easily figure out that you aren’t sending SSH or HTTP/S traffic. Hell some firewalls are application aware. Those restrictions are in place to prevent cyber security incidents I will not nor should anyone here help you get around purposefully built security measures. Use your own devices not company resources to do whatever you are trying to do. Otherwise follow proper channels if this is work appropriate. ---------------------------------------------------------------------- HearthCore · 2023-11-02 19:35 Follow the Improvement Pipleine ITIL4 structure shows. If frustration plus time equals motivation and workflow loss - then changes should be made. Workarounds in Corporate IT is reason to fire, period. ---------------------------------------------------------------------- FuriousRageSE · 2023-11-02 19:46 >Follow the Improvement Pipleine ITIL4 structure shows. > >If frustration plus time equals motivation and workflow loss - then changes should be made. Workflow loss, cant lose work when you cant work, or have to work against IT to be able to do my job. Changes? Wont happen, thats what someone laid out to be, so either go against IT, or i cant work with a good flow and not having to do alot of useless tasks to be able to work. ---------------------------------------------------------------------- machacker89 · 2023-11-02 20:42 I heard they have been cracking down on p3pl3 trying to bypass it. is that true? ---------------------------------------------------------------------- HellDuke · 2023-11-02 21:25 As someone that checks and answers /r/sysadmin I second this sentiment. Any attempts to circumvent firewalls in my company got dealt with harshly. The moment we saw traffic that was not meant to be used (even if SSH is open, if the user using SSH is not supposed to, that got flagged) and the user was either penalized or fired depending on severity of the hole being opened. ---------------------------------------------------------------------- 100GHz · 2023-11-02 21:25 Don't forget to update your resume before your experiment. :P ---------------------------------------------------------------------- sneakpeekbot · 2023-11-02 21:26 Here's a sneak peek of /r/sysadmin using the [top posts](https://np.reddit.com/r/sysadmin/top/?sort=top&t=year) of the year! \#1: [I recently had to implement my disaster recovery plan.](https:// np.reddit.com/r/sysadmin/comments/zeo31j/i_recently_had_to_implement_m y_disaster_recovery/) \#2: [Gen Z also doesn't understand desktops. after decades of boomers going "Y NO WORK U MAKE IT GO" it's really, really sad to think the new generation might do the same thing to all of us](https://np.reddit .com/r/sysadmin/comments/11k0ed5/gen_z_also_doesnt_understand_desktops _after/) \#3: [I got publicly called out today](https://np.reddit.com/r/sysadmi n/comments/10g78c7/i_got_publicly_called_out_today/) ---- ^^I'm ^^a ^^bot, ^^beep ^^boop ^^| ^^Downvote ^^to ^^remove ^^| ^^[Contact](https://www.reddit.com/message/compose/?to=sneakpeekbot) ^^| ^^[Info](https://np.reddit.com/r/sneakpeekbot/) ^^| ^^[Opt-out](ht tps://np.reddit.com/r/sneakpeekbot/comments/o8wk1r/blacklist_ix/) ^^| ^^[GitHub](https://github.com/ghnr/sneakpeekbot) ---------------------------------------------------------------------- ithilelda · 2023-11-02 23:57 well there are too many bypassing, so they mainly focus on people providing the service and developing products. RIP the author of shadowsocks. ---------------------------------------------------------------------- RoterElephant · 2023-11-03 06:04 I would not just use a different port but would use the SSH protocol itself to establish a tunnel. Everything else can be spotted easily. My suggestions: * If you want to stick to wireguard, you can use socat to transform UDP to TCP and drop it into SSH. See the [example in here](https://superuser.com/questions/53103/udp-traffic-through-ssh- tunnel) * You can tunnel through SSH itself as it supports the creation of a tun interface. Here is a [script](https://unix.stackexchange.com/questions/525217/create- network-interface-from-ssh-tunnel). * Use SSH to talk to OpenVPN via TCP. * Use SSH to talk to a socks5 proxy, but that will fail for UDP. Also prepare an sshfs setup, and claim that you listen to music streamed from your remote library to have a cover story, when you get called out for the weird traffic pattern over ssh. ---------------------------------------------------------------------- HearthCore · 2023-11-03 06:21 Sounds like migration in the works. Just like a few customers I’ve been with. Hope your tickets where these issues get evaluated reach the correct teams including the information they need to act and can get approval for improvements that way. For everything else, managers are usually responsible for team file shares and team leads responsible for the direct blockers in your daily work life. Often workflow issues are misunderstandings of the used tools or the current environment (tripple jumphost setups for example) ---------------------------------------------------------------------- adamshand · 2023-11-03 06:22 That's pretty cool, I hadn't seen it before. However it most cases the builting in `ssh -D 1080` will provide the same thing, much more easily. ---------------------------------------------------------------------- FuriousRageSE · 2023-11-03 06:53 In my line of work, my experience is, IT does know jack sh\*t about automation, our software and tools we must use, and most of those often need to be run as admin to do some simple stuff like installing a "config file" (GSD, EDS, ESI. Hardware configuration files for automaton/plc systems) My idea of IT in automation is, they only see "windows" on their network scan, then it must be an outlook and excel-computer, time to lock down and f up the line HMI royally. ---------------------------------------------------------------------- ProfessionalAd3026 · 2023-11-03 08:34 There is a high chance OP will simply be escorted out of the door. It would be the first case I have to support collecting evidence. Even in Germany where work law is rather protective for employees, this might provide enough reason for immediate termination. ---------------------------------------------------------------------- RoterElephant · 2023-11-03 09:28 I agree with you and I would happily fire an employee that circumvents policies exactly in the way I posted. But also I consider it arrogant to just go: "Hey OP, I am not answering your question, but let me tell you my opinion that what you are doing is wrong". I assume that OP is an adult and as such risking termination can be a conscious choice. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:40 I though it had to do with selfhosting because I imagine some people have faced similar issues when connecting to their home servers from a public WIFI which are usually quite restrictive. Regardless, I made a small edit explaining my situation. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:42 I've made a small edit explaining my situation, but for the sake of clarity, how could you inspect something that is encrypted, such as, an SSH connection? Not understanding the protocol from bottoms up, but given that I can even do some sort of port forwarding with SSH, allowing me access to something that is in a network where the server has access to but I, the remote client, do not, I could simply masquerade my traffic with that, right? ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:43 The mobile data is a possibility that I haven't though, but it could be an option, I just wouldn't be exactly happy about paying an extra for it, of course. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:47 I made an edit explaining my situation, and A: I can use external servers, I could, according to them, just open the SSH port on my machine to the web and use that without any problem whatsoever, I just didn't want to do it because I'm afraid of exposing my SSH port to the whole internet; B: It won't be running any software, I'm just running my code on my remote machine instead of my laptop; C: They don't know my Reddit username, it's most likely not impossible to link this back to me, but they wouldn't bother to do it anyways; D: I'm a PhD student, I don't have an acceptable work/time balance, I even work on Saturdays! I'm just trying to run my code at home, as I did before with previous institutions. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:49 I made a small edit explaining my situation, but it strikes me as surprising how can you tell someone's traffic is not SSH or HTTPs when it's completely encrypted. I imagine that, given enough effort, one could pretend its traffic to be anything really. Obviously, "enough effort" might very well be outside of my reach, but it seems theoretically possible given that the traffic is encrypted, right? ---------------------------------------------------------------------- thekrautboy · 2023-11-03 22:51 Not similar at all, and nothing about selfhosting. Enjoy waiting in line at the employment agency. Clearly you cannot take any advice and youre stubborn. Your company is better off without you. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-03 22:53 If you got the ok ==> Open Ssh and enable keyfile authentication You wont be able to connect with a simple password => Nobody can bruteforce your access Instead you need the file AND a password for ssh. A little bit like 2fa for ssh. If you do that and setup fail2ban/crowdsec its a pretty common practise to expose ssh that way. Even in the enterprise sector ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:57 Thanks for the response, and best of lucks in your quest to overcome the mighty firewall. Could you provide a conceptual overview of what do the programs that you have mentioned do and have in common? Do they create a bridge between two machines that pretend is HTTPs? I would assume that such a connection would be secure and I wouldn't need to setup Wireguard on top of it, and just SSH directly into it without anything being publicly exposed, would I be correct? ---------------------------------------------------------------------- OundercoverO · 2023-11-03 22:59 That is interesting, but would require me to have SSH open publicly, which is exactly what I'm trying to avoid! Maybe I'm being paranoid for not port forwarding my router to get SSH access from the outside world, but that's a surface of attack which does not exists if I am to have Wireguard on my machine. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 23:00 Just standard SSH, I'm just trying to avoid opening it up in my router to the public. If I could have access to extra ports on my machine that would be an added bonus, but I don't really need them if not to make a couple of experiments once in a while. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 23:03 That all seems to require SSH access, which I can only have if I were to open up a port to the internet, which is exactly what I'm trying to avoid. My point is to get SSH access from the inside of a very restrictive firewall (and hence be able to have a solution that carries securely to wherever I go in the world) without exposing my machine to the internet. I thought simply having a Wireguard tunnel would work, but it seems that it does not! ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-03 23:04 Because the initial traffic session isnt encrypted. You need to negotiate keys etc. and during that time we can see what is going on. Even then the data section of a packet might be encrypted but we can still tell after working in the field for a while based on how the packets are formed. Every protocol is unique. And some employers utilize ssl inspection to break encryption and inspect the traffic then re-encrypt on its way out. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 23:08 Yes, I am aware of that, and perhaps I'm being paranoid for never going down this route, after all SSH is made to be hardened against threats given how important it is, and if I am unable to find myself another solution, that is probably what I'll do. In my mind that's not the default route because having everything go inside a firewall and then performing key-based authentication seems a whole lot safer, because the external world isn't even aware that anything is running there, given that Wireguard does not reply to anything that isn't authenticated and only a single port in my router is forwarded to my server. So instead of trusting SSH to handle the threats, I'm trusting Wireguard to be sneaky and SSH to handle the threats, if something were to happen at the VPN level. ---------------------------------------------------------------------- OundercoverO · 2023-11-03 23:12 > And some employers utilize ssl inspection to break encryption and inspect the traffic then re-encrypt on its way out. Really? I didn't know such a thing was possible. Then that means that my ISP could also do that and snoop on my traffic without me realizing, even in HTTPs communications? ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-03 23:12 Well good option aswell. Sorry for the "Rant" in my first Post. But normally i get those questions everyday from Users that do not even know what 2fa is. Same in my Company network => If you talk to me we find a solution together =>If not, well get fucked. Sorry again. Was not against you, just had a frustrating day ---------------------------------------------------------------------- OundercoverO · 2023-11-03 23:24 No, that's fine and a perfectly reasonable response. After all, trying to do exactly the opposite of what somebody says you should do, should obviously be discouraged when that someone is the one who administers the platform. I just believe I have found myself in a situation where what I'm trying to do does not cause any harm and that their restrictions are affecting somebody who's using the services he has been provided with legitimately. For example, a friend of mine has his own machine at home which has is Dev environment and a very (very!) weak laptop that is essentially a remote screen. How would he be able to work there? He couldn't, but according to IT, a request such as this one would most likely not be accepted. Fortunately my case isn't so extreme, my laptop is reasonable, but still, an extra machine has always been helpful so far. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-04 01:08 No, your work laptop would inherently trust the cert the forward proxy is supplying as its a work environment. In an ISP situation they don’t control your computers therefore no chain of trust could be established to accomplish this. ---------------------------------------------------------------------- ithilelda · 2023-11-04 01:12 no your isp can't. that requires installing things on the client machine, and people would definitely notice if some tries to do that to personal devices. on the other hand, companies can install whatever they want to their computers, so they can do such attacks to see the encrypted messages. however that's illegal, they can't use the decrypted message as an evidence against you. but behavior inspection is enough to tell what you are doing. even if they don't know your content, they still know you are chatting with someone about something or shopping on amazon. also, if you masquerade your traffic as https and they have no idea what you are doing, strict companies could still escort you out because you have a large unknown traffic to some unknown place, meaning that you are doing personal stuff during your work hour. just remember that internet is designed to be open. it is much easier to unfold than to hide. ---------------------------------------------------------------------- ithilelda · 2023-11-04 01:53 yes you can say that they are tunneling and pretending as normal tcp traffic. firewalls know what app you are using and where you are visiting by inspecting your packets, because all protocols have some unique fingerprints. for example, wireguard traffic is unique and the firewall can easily tell that you are using it. even if you are on port 22 and the packet is converted to tcp, they still know that it is wireguard not ssh. shadowsocks and v2ray on the other hand, hide themselves as normal tcp packets so firewalls don't know what the heck that packet is, it's just normal tcp stuff, so they can't tell what you are doing. trojan is one level higher, hiding itself as https traffic so the firewall would think that it's normal https stuff. shadowsocks is not encrypted by itself, but if you are visiting https sites or ssh anyway, your messages is encrypted already, you don't need another layer. but if you are visiting lan machines using http or other clear text protocol, then shadowsocks is not safe, it only obfusicate the message, not encrypt it. you need to additionally setup an encryption layer on top of it (not wireguard, then it defeats the purpose of hiding, remember wireguard traffic is easily spottable), or use v2ray or trojan instead. I'm only writing the previous post to prove a point that your request is achievable. however, if your company is super strict, they could still have a talk with you when they see a hell lot of unknown tcp traffic from your machine, or a hell lot of https traffic, because that is a sign of you doing personal stuff during work hour. how are you gonna deal with that? also someone metioned ssl inspection. If your company practices that on their work machines, then nothing could be hided if you use the work machine. you can't circumvent those problem as long as the computer is company property. so I second the post suggesting you use mobile traffic and completely ditch anything work related. you don't need anything beside simple wireguard and you are completely safe. ---------------------------------------------------------------------- koffienl · 2023-11-04 08:28 Why not take a look on some sort web SSH so you can host it in SSL? ---------------------------------------------------------------------- OundercoverO · 2023-11-04 10:59 Ah, I'm not using a work laptop, but my own laptop, so I assume that I cannot be subject to that. Even still, I didn't know that you could break your employees encryption, even if during work hours with company machines. I would like to see what are the different countries legislation on this. ---------------------------------------------------------------------- OundercoverO · 2023-11-04 11:09 I made a small edit explaining my situation: I'm simply a PhD student with a server at home that I would like to keep safe from the internet. I'm using my own laptop and I just want to establish a connection home to run some code on my machine when my laptop is no longer suitable, so I don't feel like I'm doing anything that I shouldn't, given that in previous host universities this was perfectly reasonable. Here, however, that is considered unsafe, for some reason. To get back to your reply: So if something like shadowsocks is merely turning your packet into something that looks like TCP, but not encrypting it, wouldn't a packet inspection reveal what I am doing anyways? Based on your description, it seems like v2ray and trojan are much more safe to use out of the box, with both obfuscation and encryption altogether. ---------------------------------------------------------------------- OundercoverO · 2023-11-04 11:10 Well given that traffic via port 22 is allowed, what difference would that make when compared with simply opening port 22 to the internet? ---------------------------------------------------------------------- ithilelda · 2023-11-04 11:56 well I checked again. shadowsocks do have encryption, just not based on tls. it is a simple encryption layer on top of socks5. sorry my bad. shadowsocksR is the one that adds obfuscation on top of shadowsocks. there is an ongoing battle againt the GFW for quite a long time so info gets messy in my head😂 based on your updated info, there is absolutely no legal issues whatsoever, so they won't care if you are hiding traffic. they just shutdown other ports because they don't want people to play online video games or do fancy stuff that comsumes a lot of the bandwidth. then you do not need anything I mentioned. they are quite an overkill. go with your original plan, udp2raw or udp2tcp to convert wireguard's udp packets to tcp, and have your home wireguard node listen on port 443 or 22 (pick whichever you like). that should be more than sufficient. v2ray and trojan are much harder to configure. but if you like to learn something new, I do recommend you look into them and they may become handy when you really need them like after you graduate lol. ---------------------------------------------------------------------- OundercoverO · 2023-11-04 16:58 Alright, thanks for the info, it was quite helpful. I'll go for the simple route first, and if that either fails or I would like to setup something more sophisticated, then I will look into shadowsocks(R) or any other of the tools that you have mentioned. > they just shutdown other ports because they don't want people to play online video games or do fancy stuff that comsumes a lot of the bandwidth Yeah I think that too, that's why I'm not particularly worried about trying to circumvent these kind of restrictions, I don't really see any harm in doing this. Best of lucks in your fight against the great firewall! ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-09 02:57 It would be used to protect against malicious sites / scripts embedded in ads or webpages. Phishing pages prevention of leaking certain data. Not really used for spying / keylogging we dont care about your PII data but we dont want to be sure you arent sending confidential data like PII to outside unauthorized sources. If we really wanted to check in that an employee was working and not doing their jobs there is ample other avenues to take. ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:11 This might be what you're looking for https://github.com/NOXCIS/Wiregate ---------------------------------------------------------------------- TheFlyingBaboon1 · 2023-12-31 16:44 You could only expose your ssh port to only a certain ip, for example the public IP of your employer. Most routers have an accepted ip condition for port forwarding.