4 ms·

In some networks, I only have outgoing tcp ports 80 and 443. Does anyone have experience with udp2raw or udptunnel?

by aborsy 5y ago

Datagenerator 5y ago
You might want to use [1] 1) https://github.com/lrvl/tunnel-wireguard-udp2tcp https://github.com/lrvl/tunnel-wireguard-udp2tcp
- corty 5y ago
  That is a first step, but what you really want to do (and what most commercial VPN solutions are doing) is tunneling the VPN via https. Preferably with a real-looking web server at one end, so that "firewall solutions" have something to look at and scan for evil keywords. Oh, and you might have to disguise the traffic pattern as something that looks like http, so frequent reconnects. And the payload has to be web-like so that a MitM-proxy sees something like http, so an one direction is a POST, the other is the respective response, and if you cannot do persistent connections because the proxy kills them you'll have to poll at least in one direction. Yes, this is supremely ugly, but unfortunately entrenched and expected by now. I've been to customers with intrusive filtering/scanning setups like that who then recommended their favourite commercial VPN vendor to get around that filtering...
PhantomGremlin 5y ago
This is just insane. Everything except WWW is blocked, so everything must pretend to be WWW???!!! So can anyone explain the purpose of the "source port" and "destination port" fields in the TCP header? :-)
- corty 5y ago
  Seems you missed the "big web revolution" between 2000 and now. Corporate/school/uni firewall madness filters everything but http(s), so each and every protocol has to be somehow http(s). That is why there are almost exclusively webmail providers anymore. Why stuff like videoconferencing must be http-based. Why we do everything by emulating better protocols via polling a webserver for xml or json responses. Yes, it is insane.
- riobard 5y ago
  By that logic someone has to explain why WireGuard is over UDP and the purpose of the "protocol" field of IP header :-) It's called ossification. Same reason why TLS 1.3 has to pretend it's TLS 1.2, and QUIC must be over UDP.
- e12e 5y ago
  It is insane. But probably some ICMP is allowed too - otherwise TCP tends to break in subtle ways... it is possible to whitelist some/necessary ICMP traffic though.

In some networks, I only have outgoing tcp ports 80 and 443. Does anyone have experience with udp2raw or udptunnel?

by aborsy 5y ago

In some networks, I only have outgoing tcp ports 80 and 443. Does anyone have experience with udp2raw or udptunnel?

You might want to use [1] 1) https://github.com/lrvl/tunnel-wireguard-udp2tcp https://github.com/lrvl/tunnel-wireguard-udp2tcp

corty 5y ago
That is a first step, but what you really want to do (and what most commercial VPN solutions are doing) is tunneling the VPN via https. Preferably with a real-looking web server at one end, so that "firewall solutions" have something to look at and scan for evil keywords. Oh, and you might have to disguise the traffic pattern as something that looks like http, so frequent reconnects. And the payload has to be web-like so that a MitM-proxy sees something like http, so an one direction is a POST, the other is the respective response, and if you cannot do persistent connections because the proxy kills them you'll have to poll at least in one direction. Yes, this is supremely ugly, but unfortunately entrenched and expected by now. I've been to customers with intrusive filtering/scanning setups like that who then recommended their favourite commercial VPN vendor to get around that filtering...

PhantomGremlin 5y ago

This is just insane. Everything except WWW is blocked, so everything must pretend to be WWW???!!! So can anyone explain the purpose of the "source port" and "destination port" fields in the TCP header? :-)

corty 5y ago
Seems you missed the "big web revolution" between 2000 and now. Corporate/school/uni firewall madness filters everything but http(s), so each and every protocol has to be somehow http(s). That is why there are almost exclusively webmail providers anymore. Why stuff like videoconferencing must be http-based. Why we do everything by emulating better protocols via polling a webserver for xml or json responses. Yes, it is insane.
riobard 5y ago
By that logic someone has to explain why WireGuard is over UDP and the purpose of the "protocol" field of IP header :-) It's called ossification. Same reason why TLS 1.3 has to pretend it's TLS 1.2, and QUIC must be over UDP.
e12e 5y ago
It is insane. But probably some ICMP is allowed too - otherwise TCP tends to break in subtle ways... it is possible to whitelist some/necessary ICMP traffic though.