How to pass website firewall, in PHP? [closed]

Question

Recently, I have posted a question, (https://stackoverflow.com/questions/37494896/how-to-save-file-from-url-to-web-server-by-php). And, there is an answer in question.

In this answer, he said: "So the ability to connect to external hosts is blocked by a firewall and is not possible.". Tt nearly means: "There is no way that my server can't get outside data". But, I don't know: "Why Google can get some data from my website, as HTML page, easily?".

I really want to ask: "Why SourceForge's administrators block my web by a firewall? And, Is there any way to pass the firewall, and get some data, with PHP?".

Answer 1

Google is an external service, connecting into your server. A web server's firewall will normally be configured to allow this. You are trying to connect out from your server, which may well be blocked, since most web servers don't need that ability. You don't need it, for example, to include a Twitter feed (that's client side loaded), to upload files to your server (you connect in, using SFTP, rather than it connecting out), or any other common tasks. However, blocking outbound traffic in this case can prevent abuse of a compromised server for use as a spam sender, or as part of a DDoS attack.

SourceForge probably block it to prevent abuse of this kind, especially since it's easy for people to sign up and be allowed to run files on their server. If you do need to connect from your server to another location, you'll have to use a different provider.

Additionally, asking for ways to bypass security systems, which you do at the end of your question, is off-topic. The restrictions might be frustrating, but by using the service, you have to agree with the rules, especially when, as in this case, there are many alternatives that you could use.

Answer 2

Why SourceForge's administrators block my web by a firewall?

The answer on StackOverflow explains it all really. Previously, SourceForge allowed outgoing requests and this was abused, so they no longer allow it.

Why Google can get some data from my website, as HTML page, easily?

Because Google is not behind SourceForge's firewall (obviously) and SourceForge's robots.txt doesn't stop it.

And, Is there any way to pass the firewall, and get some data, with PHP?

I suggest you find a different web host (or a VPS) as SourceForge isn't even really a fully-fledged web host but more of a file repository for Open Source Software. Even if you did find a vulnerability in their systems to let you circumvent the firewall you'd be breaking the ToS and probably get your account suspended.

Answer 3

Although Fluffy and Matthew both suggest that the reason for the policy is to prevent abuse of SourceForge's services, implying that someone with legitimate access to the content would abuse that privilege, it's also worth noting that it also provides protection for your content / site. If your site has an file injection/inclusion vulnerability, such as...

include($_GET['run_this_code']);

then anyone can run any code they want on the server. Although there are various ways to mitigate such vulnerabilities (some are much more sublte than the one above) egress filtering not only provides protection against the vulnerability but also containment for this and other security issues.

Asking why a security policy exists is a legitimate question (and far too often unanswered) but asking how to bypass security will not win you many friends here and is probably the reason for the downvotes/closevotes.