12 ms·
Why not just use an HTTP CONNECT proxy?
by shawnz 3y ago
Why not just use an HTTP CONNECT proxy?
- lxgr 3y agoThat doesn't give you full IP tunneling, only a TCP socket connection, which might or might not be enough for what you're trying to do. I could also imagine that many corporate firewalls know HTTP CONNECT and filter it.
- shawnz 3y agoWith CONNECT-UDP you also get UDP, just like this, and over HTTPS it's not going to be filterable, right?
- lxgr 3y agoYeah, I suspect it's pretty similar using HTTP/2 when considering all of these new proxy modes; I've been wondering as well if there are any other differences or if it just predates the specification of that (and UDP over HTTP). With HTTP/1, I don't think there is a way to multiplex multiple TCP or UDP bindings over a single connection – maybe this supports it? The diagram seems to suggest it, and e.g. SSH does too (and is equivalent to CONNECT proxying over HTTP/2 in that sense).
- kbolino 3y agoLarge enterprise firewalls generally do not allow true end-to-end HTTPS. The firewall masquerades as the destination sites using custom certificates, issued on-the-fly under a custom root CA controlled by the firewall, which is pre-installed on every device approved for use in the enterprise. Certain sites (e.g. banks) and certain users (e.g. C-suite) may be exempt from this by policy, but the default policy is to MITM all connections.
- FrostKiwi 3y agoUsing Proxytunnel [1] to do specifically this, in an environment where a packet inspecting proxy prevents SSH traffic. It supports connecting over HTTPs, so the traffic doesn't look fishy with the setup of: SSH Client -> HTTPs Encryption -> Corporate Packet Sniffing Proxy -> Your Server -> HTTPs Decryption -> SSHD Server Looking forward to explore chisel as well. [1] https://github.com/proxytunnel/proxytunnel https://github.com/proxytunnel/proxytunnel