4 ms·

I had an sstp tunnel refuse to establish a few weeks ago. WireGuard was fine. Turns out the provider was MITMing tcp/443 traffic

planetafro 5y ago
Wouldn't they need a cert/custom CA on your box to do that?
- SahAssar 5y ago
  They could just block all tcp/443 traffic that they couldn't MITM, that's not uncommon in those kinds of setups.
- agolliver 5y ago
  They need their custom CA on your box for your machine to accept the traffic by default, otherwise you'll get a big ugly untrusted cert error on every https/ssl connection, but some apps will let you ignore those (eg: curl --insecure) I worked at a company that did this and it was a massive headache, every time I wanted to set up a new VM things would fail until I remembered I had to install their CA. I was an intern at the time, and they gave me some work that required an app that I couldn't configure to use their CA for the life of me. After a lot of failed troubleshooting I and ended up just running a SSH server on my home PC and creating a SOCKS proxy through that.
- no_time 5y ago
  Yes. My university was using Fortigate back in the day and it had 3 behaviours -Allow with no mitm (trusted sites) -Block with no way around it(all residental IPs, pornsites) -Allow but mitm the connection. The browser would present the classic ERR_UNKNOWN_ISSUER warning that most people would ignore. I couldn't figure out what criteria decided that a certain site needs the mitm treatment.
  - gspr 5y ago
    Ah yes, exactly the kind of intellectual freedom to explore and tinker you'd want to flourish at a university. Better block it! Wild guess: US?
    - xvector 5y ago
      Eh, if you care about privacy you shouldn't be browsing porn without a VPN or tunnel to a trusted server, "intellectual freedom" or not
      - no_time 5y ago
        In theory, if the tls connection wasn't tampered with, i.e the cert issuer is a party you trust, it shouldn't be a problem apart from the dns query.
      - gspr 5y ago
        I was referring to residential IPs.
        no_time 5y ago
        Yep, by far that was the biggest PiA because I was hosting a lot of things at home.
    - no_time 5y ago
      >Wild guess: US? Hungary. My theory is that it was installed to curb filesharing and then it snowballed into generic blocking of various things on the university network. >intellectual freedom to explore and tinker you'd want to flourish at a university. Ah that sounds sweet. Reminds me of the anecdotes I read from the pioneer age of computing that people tell here sometimes. Well, the place I studied at was nothing like that. >_>
fomine3 5y ago
It's interesting that such "provider" (I assume corporate network, rather than consumer ISP) allows traffic on WireGuard UDP port.
- midasuni 5y ago
  It was a U.K. university building They asked what ports we wanted (sigh), we said all, I suspect the ports were opened but MITM wasn’t disabled. Oddly it either passed through u mileages or it broke connections completely without inserting a fake cert. Even more oddly GitHub was blocked but stackoverflow was allowed. As we turned up in the vans on the Saturday morning and the recee team hadn’t clocked this (to be fair most https sites worked fine) we couldn’t get it changed - or the process for changing it was far too much given the other stuff we had to set up and the ease of the workarround.

planetafro 5y ago

Wouldn't they need a cert/custom CA on your box to do that?

SahAssar 5y ago
They could just block all tcp/443 traffic that they couldn't MITM, that's not uncommon in those kinds of setups.
agolliver 5y ago
They need their custom CA on your box for your machine to accept the traffic by default, otherwise you'll get a big ugly untrusted cert error on every https/ssl connection, but some apps will let you ignore those (eg: curl --insecure) I worked at a company that did this and it was a massive headache, every time I wanted to set up a new VM things would fail until I remembered I had to install their CA. I was an intern at the time, and they gave me some work that required an app that I couldn't configure to use their CA for the life of me. After a lot of failed troubleshooting I and ended up just running a SSH server on my home PC and creating a SOCKS proxy through that.
no_time 5y ago
Yes. My university was using Fortigate back in the day and it had 3 behaviours -Allow with no mitm (trusted sites) -Block with no way around it(all residental IPs, pornsites) -Allow but mitm the connection. The browser would present the classic ERR_UNKNOWN_ISSUER warning that most people would ignore. I couldn't figure out what criteria decided that a certain site needs the mitm treatment.
- gspr 5y ago
  Ah yes, exactly the kind of intellectual freedom to explore and tinker you'd want to flourish at a university. Better block it! Wild guess: US?
  - xvector 5y ago
    Eh, if you care about privacy you shouldn't be browsing porn without a VPN or tunnel to a trusted server, "intellectual freedom" or not
    - no_time 5y ago
      In theory, if the tls connection wasn't tampered with, i.e the cert issuer is a party you trust, it shouldn't be a problem apart from the dns query.
    - gspr 5y ago
      I was referring to residential IPs.
      - no_time 5y ago
        Yep, by far that was the biggest PiA because I was hosting a lot of things at home.
  - no_time 5y ago
    >Wild guess: US? Hungary. My theory is that it was installed to curb filesharing and then it snowballed into generic blocking of various things on the university network. >intellectual freedom to explore and tinker you'd want to flourish at a university. Ah that sounds sweet. Reminds me of the anecdotes I read from the pioneer age of computing that people tell here sometimes. Well, the place I studied at was nothing like that. >_>

fomine3 5y ago

It's interesting that such "provider" (I assume corporate network, rather than consumer ISP) allows traffic on WireGuard UDP port.

midasuni 5y ago
It was a U.K. university building They asked what ports we wanted (sigh), we said all, I suspect the ports were opened but MITM wasn’t disabled. Oddly it either passed through u mileages or it broke connections completely without inserting a fake cert. Even more oddly GitHub was blocked but stackoverflow was allowed. As we turned up in the vans on the Saturday morning and the recee team hadn’t clocked this (to be fair most https sites worked fine) we couldn’t get it changed - or the process for changing it was far too much given the other stuff we had to set up and the ease of the workarround.