6 ms·
Wouldn't a VPN or tunnelling solution be better? You pass all your traffic through a fixed port on one host, then unwrap it and use the web as though the restri
by BillinghamJ 11y ago
Wouldn't a VPN or tunnelling solution be better? You pass all your traffic through a fixed port on one host, then unwrap it and use the web as though the restriction wasn't there.
- sigjuice 11y agoVPN or tunneling solutions are unlikely to work if severe network restrictions are in place. e.g. firewalls that only allow TCP ports 80 and 443.
- vidarh 11y agoNothing stops you from passing a VPN through a TCP connection on port 80 and 443. There are few protocols people haven't tunnelled IP over (DNS included...)
- joushou 11y agoActually, yes, packet inspecting firewalls do. Hence the SSH over TLS, to make things stealthy.
- Retr0spectrum 11y agoI often have to work behind "smoothwall". AFAIK, it only allows HTTP over port 80 and HTTPS on port 443 - any other protocol on any other port gets blocked, including other protocols over port 80/443. To bypass this, I wrote a simple ruby script to tunnel TCP connections, while adding fake HTTP headers to get through the firewall.
- voltagex_ 11y agoCan you share that script?
- thatcat 11y agoobfsproxy with obfs3 as a pluggable transport does somthing similar, it's made for tor bridges but i'm sure you could use it for vpn traffic too. https://www.torproject.org/projects/obfsproxy.html.en https://www.torproject.org/projects/obfsproxy.html.en https://gitweb.torproject.org/pluggable-transports/obfsproxy.git/tree/doc/obfs3/obfs3-protocol-spec.txt https://gitweb.torproject.org/pluggable-transports/obfsproxy...
- derefr 11y agoWith only a bit of extra state-machine glue, you'd have a clean and standards-compliant websocket-based VPN.
- debaserab2 11y agoDifferent, but not better depending on your requirements. Tunneling over a VPN can be pretty slow.
- cbhl 11y agoGenerally these well-intentioned networks block the usual VPN and tunneling solutions (think kid and a school network with a firewall that only allows FTP, HTTP, and HTTPS).
- falcolas 11y agoDoesn't even have to be that nefarious - I am blocked from using my OpenVPN tunnel (UDP and TCP) from at least two restaurants that I'm aware of.
- deleted 11y ago[deleted]
- stock_toaster 11y ago"Those who sacrifice connectivity for bourguignon deserve neither." -- Internet Ben Franklin
- revelation 11y agoAt which point you simply use these ports for your VPN. OpenVPN can use TCP, it can use UDP, it can use whatever port you like, it can even use a fixed key to turn all traffic into random noise (obfuscating protocol structures).
- falcolas 11y agoThus the value of having a multiplexer which allows you to run these on 80 and 443, while still running a web server.
- ori_b 11y agoYeah, but these well intentioned networks also often do packet inspection to block simple workarounds.
- joushou 11y agoSSH with SOCKS5 tunnelling enabled does exactly this. The trick is that VPN's aren't allowed very often, so that's where the TLS tunnel trick steps in. You can use a VPN over TLS with serve2d if you want. I just find ssh -D5000 easier to set up quickly "in the field" than a VPN, especially seeing that it doesn't require server configuration.