4 ms·
As long as only one side of the connection is behind a corporate NAT you could simply try all 65535 ports until you find the one that works. The side behind the
by jgeralnik 7y ago
As long as only one side of the connection is behind a corporate NAT you could simply try all 65535 ports until you find the one that works. The side behind the NAT would receive the packet and then be able to respond.
- noname120 7y agoAnd then you're blacklisted by the corporate firewall for doing what looks like port scanning.
- jacobush 7y agoAll 3 corporate firewalls I have been behind have been HTTP only. No actual internet connection. (Except for DNS, which worked.)
- imglorp 7y agoDNS working in a corporate IT environment is a surprise. Often, clients are issued an internal DNS server via DHCP, and outbound DNS to arbitrary servers is blocked. This helps mitigate DNS hijacking and also allows some additional outbound domain filtering and logging.
- jacobush 7y agoOh, yes, DNS is an internal DNS. You can't change it. I meant, it's the only way to "trickle leak" data without it going through the filtering proxy. But who knows, maybe the DNS requests are logged too, but they don't seem to be filtered. Edit: they are filtered. Suspicious names go to 127.0.0.1
- big_chungus 7y agoAnd of course, with the advent of DNS over HTTPS, this is no longer as effective. I can still access blocked sites and get around logging, I just have to set up a tunnel to cloudflare.
- jlg23 7y agoWhich, from a security point of view, would be grounds for immediate termination and quite some companies I worked for would try to sue you to pay for impact assessment. (connecting a usb-modem is much safer, I'd have to actually spot the device which would require getting out of my chair... ;)
- big_chungus 7y agoThe point is not really for me to circumvent restrictions, it's more that a bad actor could. This can largely defeat the purpose; though malware using this is not common, it's started to crop up.