Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since routers interface is on port 80?
Would TOR be a better solution for something like this?
I often use Tor for this kind of tunneling. If Tor works in your network environment, set up a hidden service. The directory /var/lib/tor (GNU/Linux) has a subdirectory for your hidden service. Inside is a file called hostname. You add a section in you .ssh/config:
Host *.onion
ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050
plus maybe other options. Now you can connect to your machine using ssh hidden-service-hostname.onion and no firewall will stop you.
It's actually very easy to create a single port tunnel to take advantage of whatever port is open on a router. This happens a lot in security testing - maybe I can take advantage on a vulnerability on a server, but I then want to do something useful with it such as escalate the attack further. What I then usually do is run netcat to create an outgoing channel (say on port 80 which looks to a router or firewall just like web traffic.)
It shouldn't matter that your router command port is port 80 - that is only relevant if you wish to connect to the router, but in terms of routing through the router this solution should do what you need.
Quick follow up as my comment on Shewfig's is possibly not very clear:
You can run any service on any port (pretty much) so running an encrypted service such as SSH on port 80 is fine. It will not open you up to attacks on html as you aren't running an html server on this port. There is also a big difference between outbound ports open and inbound. If you have port 80 open outbound, the router/firewall will typically allow replies on a high port (ie not port 80)
There is an old but still partially relevant document called the firewall piercing howto. It is aimed at students who use Linux and find themselves trapped at some internship places behind a restrictive firewall which prevents them from slacking with the help of their favourite network-enhanced tools. On a general basis, I do not condone circumventing security features; but this is interesting reading (if somewhat obsolescent) if you want to understand network issues.
You could probably set up port forwarding, e.g. for a specific hostname/path, and have only those packets sent over to the other machine to be detunnelled. But this would depend very much on your router.
Just an additional comment re TOR - please take into account that while TOR might be invaluable for anonymoziation, it actually greatly harms your confidentiallity. So depending on what you're tunneling, you probably don't want any TOR node (and let's face it, most of them by now are malicious) viewing and altering your data.
The answer really depends on what you're really trying to accomplish.
If you're trying to create a generic proxy connection to your home network from inside this hypothetical "80 outbound only" network, then there are 2 things wrong: 1) SSL typically is hosted on 443: 80 is typically non-encrypted. Allowing only port 80 outbound guarantees that surfing from that network will get you pwned. 2) Your home router is listening to the internet on port 80, which will get it pwned.
If you're trying to create a proxy from the "80 only" network to browse the web from a different IP address, there are lots of public proxies for this already.
If you're trying to access your home PC from the "80 only" network, there are solutions like GoToMyPC and LogMeIn which do this by mediating the connection.
As a generic answer, I'd say that you should config your home router to stop listening itself on port 80 (turn off cleartext http, SSL only), then port forward 80 to 22 on your home server. Bonus points for configuring iptables on your home server to do port forwarding from 80 to 22 if browsed from the "80 only" network, and to stay on 80 for all other networks.
