10
4
Assumptions:
Server:
- I have a Debian Squeeze server, routable on the public Internet, with a static IPv4 address.
- I have unrestricted access to modify the software on the server.
- The server can listen on arbitrary ports, reconfigure firewall rules, basically there are no restrictions on what the server can be made to do.
Client:
- I can run Firefox, Java programs, .NET programs, and some native executables that don't require admin access on my local system (a locked-down Windows desktop with no admin rights).
- I can install Addons into Firefox.
- I can listen on any port on the loopback (
localhost
) interface. So, aforementioned programs can bind to a local port and perform arbitrary network I/O, without going through a proxy. - All public Internet access is routed through a restrictive HTTP proxy which blocks many sites, and does careful stateful inspection. On port 80, it allows exclusively HTTP (no TLS/SSL). On port 443, it allows
CONNECT
based SSL/TLS to remote hosts which are not blocked by domain name / IP address. - The restrictive HTTP proxy does not perform deep packet inspection of TLS connections which are allowed through the proxy, and it does not perform Man in the Middle attacks on those connections.
- The above-mentioned server I have access to, is not blocked by the proxy.
Goal:
I want to route all HTTP and HTTPS requests emitted by Firefox, through the above server, over SSL/TLS.
Other notes about the "Goal":
- Even if the endpoint site (for example,
http://superuser.com
) is not using SSL/TLS to my server, I still want to use SSL/TLS from my client to my server, and have my server perform the HTTP request -- whether encrypted or not -- to my desired destination. - I do not care if my server is looking at the SSL traffic "in the clear". In other words, I do not require full end-to-end SSL encryption from my local client, all the way to the remote server, if the remote server is being accessed by e.g.
https://google.com
. In other words, I trust the server to keep my data confidential. - I am willing to install any software or Firefox addons that do not require admin rights and can run on 32-bit Windows 7.
- Open source software is preferred over proprietary, and freeware is preferred over software requiring a license fee.
- Existing software is preferred over having to code up new software, though I am willing to write code if that is the only way.
I am looking for a loosely described "solution" that describes:
- What software would be required on the client? If there is a specific software package you are aware of, name it; otherwise, describe what the client software would have to do.
- What software would be required on the server? If there is a specific software package you are aware of, name it; otherwise, describe what the server software would have to do.
- If you named specific software packages above, describe what configuration parameters would be necessary to set it up to meet my goal.
- If for some reason you believe this is not possible, describe why.
Things I've Tried That Don't Work
- Installing
squid
on my server, I tried to set up a standard HTTP proxy of my own on my server. This didn't work out, because when I request websites in Firefox over regular HTTP, Firefox tries to access my server over regular HTTP, too! This is not acceptable, because the proxy on my local network can of course observe and/or block the regular HTTP traffic between my client and the server. - VPNs don't work, not even OpenVPN over TLS listening on port 443, because I don't have the permissions on the local computer to install a
tun
network adapter that can perform layer 3 routing, nor can I do any sort of layer 2 routing (e.g.tap
). In short: I'd need admin rights to install OpenVPN, and even if I had those admin rights temporarily, the company would be none too pleased if they found it was installed. A Java or .NET program is much less noticeable, especially when it isn't installed in Add/Remove Programs and has no kernel driver component like OpenVPN does.
Do you try Socks? you can define it on port 443 in your server. – Ashian – 2014-08-12T05:10:37.920
Can you use the solution described in this article: Poor man’s HTTP VPN? Note that its link to HTTPTunnel is incorrect.
– harrymc – 2014-08-12T06:36:46.5031http://delegate.org/ might be of help. – Arjan – 2014-08-12T07:47:11.343
@Ashian No, SOCKS will not work, unless it is wrapped in TLS. SOCKS is not an HTTP based protocol, so when it hits the internal proxy, it will be blocked. And if I were able to run it through TLS, I would probably use a different protocol. My first problem is getting the TLS tunnel set up in a way that Firefox can use it. I still haven't seen an explanation of how to do that. – allquixotic – 2014-08-12T11:43:54.493
@harrymc: The question title says through TLS. HTTP Tunnel routes IP packets over HTTP, which is unencrypted and does not use TLS. The article itself says the connection is not encrypted. There's no way my proxy would let that through. Furthermore, I don't have
socat
or administrative privileges on the Windows client box. – allquixotic – 2014-08-12T11:46:15.663@Arjan DeleGate could possibly have the functionality I need, but can you find anything in its docs that will let me use it as a SSL/TLS proxy for all web traffic in Firefox, both for HTTP and for HTTPS websites? – allquixotic – 2014-08-12T11:47:56.447
Which ports does the proxy allow? – harrymc – 2014-08-12T15:06:46.400
As I wrote in my post: "On port 80, it allows exclusively HTTP (no TLS/SSL). On port 443, it allows CONNECT based SSL/TLS to remote hosts which are not blocked by domain name / IP address." It only allows those two ports, and it only allows specifically HTTP on port 80, and specifically TLS/SSL sockets on port 443. So, something like SSH or OpenVPN won't work over 443, unless it's first wrapped in TLS (which would defeat the purpose of using a protocol that's already encrypted), because the firewall will know it's not TLS and block it. But it can't tell what's inside the TLS. – allquixotic – 2014-08-12T16:36:11.977
So theoretically, the TLS bitstream could house any conceivable protocol and it would allow it through the firewall. The problem is that "regular" HTTP proxies, like Squid, typically don't encrypt unless you're accessing the remote website over HTTPS. – allquixotic – 2014-08-12T16:38:05.920
Does the proxy block TCP, UDP or both? – harrymc – 2014-08-12T17:48:48.207
And are you sure that the proxy will block TLS over HTTP? Because both HTTPTunnel and GNU httptunnel don't need admin rights on the client.
– harrymc – 2014-08-12T17:54:29.547Also see this : 9 Ways to Bypass a Firewall or Internet Filter - wikiHow.
– harrymc – 2014-08-12T18:02:11.000I think Delegate is what you should be looking at. There are a few usage examples here. But this is probably what you're looking for.
– Vinayak – 2014-08-12T18:12:52.747@harrymc HTTP is over TCP (by definition), so it doesn't block TCP on ports 80 or 443. The TLS sessions it allows on port 443 have to be done using TCP as well. You can probably encapsulate arbitrary packets -- even UDP -- within the tunnel, but as far as the proxy can see, it'll still be raw TCP packets being sent once the end-to-end TLS handshake has completed. – allquixotic – 2014-08-12T19:14:48.427