Hacker News Reader

Comment by BillinghamJ | Hacker News Reader

Wouldn't a VPN or tunnelling solution be better? You pass all your traffic through a fixed port on one host, then unwrap it and use the web as though the restriction wasn't there.

View on HN

VPN or tunneling solutions are unlikely to work if severe network restrictions are in place. e.g. firewalls that only allow TCP ports 80 and 443.

Nothing stops you from passing a VPN through a TCP connection on port 80 and 443. There are few protocols people haven't tunnelled IP over (DNS included...)

Actually, yes, packet inspecting firewalls do. Hence the SSH over TLS, to make things stealthy.

I often have to work behind "smoothwall". AFAIK, it only allows HTTP over port 80 and HTTPS on port 443 - any other protocol on any other port gets blocked, including other protocols over port 80/443.

To bypass this, I wrote a simple ruby script to tunnel TCP connections, while adding fake HTTP headers to get through the firewall.

Can you share that script?

obfsproxy with obfs3 as a pluggable transport does somthing similar, it's made for tor bridges but i'm sure you could use it for vpn traffic too.

https://www.torproject.org/projects/obfsproxy.html.en

https://gitweb.torproject.org/pluggable-transports/obfsproxy...

With only a bit of extra state-machine glue, you'd have a clean and standards-compliant websocket-based VPN.

Generally these well-intentioned networks block the usual VPN and tunneling solutions (think kid and a school network with a firewall that only allows FTP, HTTP, and HTTPS).

Doesn't even have to be that nefarious - I am blocked from using my OpenVPN tunnel (UDP and TCP) from at least two restaurants that I'm aware of.

At which point you simply use these ports for your VPN.

OpenVPN can use TCP, it can use UDP, it can use whatever port you like, it can even use a fixed key to turn all traffic into random noise (obfuscating protocol structures).

Thus the value of having a multiplexer which allows you to run these on 80 and 443, while still running a web server.

Yeah, but these well intentioned networks also often do packet inspection to block simple workarounds.

SSH with SOCKS5 tunnelling enabled does exactly this. The trick is that VPN's aren't allowed very often, so that's where the TLS tunnel trick steps in. You can use a VPN over TLS with serve2d if you want. I just find ssh -D5000 easier to set up quickly "in the field" than a VPN, especially seeing that it doesn't require server configuration.

Different, but not better depending on your requirements. Tunneling over a VPN can be pretty slow.

Reply on news.ycombinator.com