How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the user on the firewall?

I have searched these questions and answers but none of them directly answering the question:

I knew its by implementing any kind of reverse shell, creating a tunnel that sending outbound connection to attacker server: Why a tunnel - reverse shell not detected by Firewall or such Antivirus on the OS? until this point, I worked on many computers and tested if a tunnel works or not, none of them blocked me even with enterprise firewall and client security software.

  • 2
    That's an excellent question. The reverse SSH tunnel is initiated from the server, to the attacker's host. So, the firewall in front of the server sees it as an outgoing connection from the server, not an incoming connection - therefore the firewall allows the outgoing connection. This sets up an encrypted tunnel between the server and the attacker's host. The attacker can then connect back to the server through the tunnel that is already established (hence the name 'reverse tunnel'), but the firewall cannot see this because it is 'inside' the encrypted tunnel.
    – mti2935
    Commented May 30, 2023 at 0:30
  • Let us continue this discussion in chat.
    – Akam
    Commented May 30, 2023 at 17:57

1 Answer 1


Because there is nothing inherently wrong with a computer connecting out to the internet. Your browser does this multiple times a minute when in use.

AV can detect binaries that are known to be potentially used for malicious purposes. But the same tools used for troubleshooting (e.g. netcat) can also be used for malicious purposes.

And firewalls do detect strange outgoing connections. If the connections are, indeed, strange. Some firewalls ask the user if all outgoing connections are authorised (Windows used to do this) but users were bombarded with connection requests to approve, so that approach was abandoned.

As for servers, the basic hardening guidance is to only allow outgoing connections that are pre-approved (IP lists), and this cuts down on the chance for tunnels to succeed.

  • So now the question is why enterprise firewalls not able to detect this well known threat which is very easy to detect based on signature and behaviour of the connection.
    – Akam
    Commented May 30, 2023 at 21:15
  • I already talk about that in the answer.
    – schroeder
    Commented May 30, 2023 at 21:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .