Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

github.com

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#41

Post by bauruine »

pogue wrote: post #31
GoblinSlayer wrote: post #28

Earlier quoted context omitted.

Spamhaus blocks port 25, not 587. If they blocked port 587, they would blanket ban all email clients.

SpamHaus lists IPs to blocks, not ports.

Sure but from your link

>The PBL detects end-user IP address ranges which should not be attempting to directly deliver unauthenticated SMTP email to any Internet mail server. All the email originated by an IP listed in PBL is expected to be submitted - using authentication - to a SMTP server which delivers it to destination

Means in practice port 25 (unauthenticated) and port 587 (authenticated)

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#43

Post by megous »

pogue wrote: post #9
zamadatix wrote: post #7

Earlier quoted context omitted.

TECHNICAL.md lays it out a bit more, but it claims to be RFC 5321 compliant with a realistic initiation sequence so it should somewhat look like a real SMTP server for the first bit. Ending up on any DNSBLs shouldn't be a problem unless you have a static home IP you plan on running an actual SMTP server from after this though.

>SMTP traffic on port 587 (submission) is expected and normal Any residential dynamic or static IP with this port opened is definitely going to get flagged. Most ISPs already prevent these ports from being open, either by policy or by residential routers. It would probably very quickly end up on something like SpamHaus's PBL, which looks for this kind of thing.[1] I would imagine you would also find yourself on Shoda…

> Any residential dynamic or static IP with this port opened is definitely going to get flagged.

That's not what the referenced website says and it does not make sense at all.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#44

Post by megous »

sebazzz wrote: post #10
catlifeonmars wrote: post #5

Earlier quoted context omitted.

What would you reach for out of curiosity? For me RTP+rateless erasure codes come to mind, but I’m feeling Rube Goldbergy today.

I think HTTP web sockets would be an interesting tunneling protocol.

You don't need websockets, just Connection: Upgrade to anything you want. You can upgrade directly to ssh protocol and just pass on decrypted data from https socket to local port 22 from then on with no further processing.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#46

Post by ranger_danger »

stackskipton wrote: post #33
Gathering6678 wrote: post #15

I suppose it would be trivial to simply block or severely throttle high-volume SMTP traffic?

You could block SMTP on almost all end user networks with no one noticing. 99.9+% of email client submission is HTTPS.

Source:

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#47

Post by ranger_danger »

megous wrote: post #44
sebazzz wrote: post #10

Earlier quoted context omitted.

I think HTTP web sockets would be an interesting tunneling protocol.

You don't need websockets, just Connection: Upgrade to anything you want. You can upgrade directly to ssh protocol and just pass on decrypted data from https socket to local port 22 from then on with no further processing.

Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#48

Post by bauruine »

stackskipton wrote: post #33
Gathering6678 wrote: post #15

I suppose it would be trivial to simply block or severely throttle high-volume SMTP traffic?

You could block SMTP on almost all end user networks with no one noticing. 99.9+% of email client submission is HTTPS.

I doubt it's that much but with the same logic you could also ban HN, SSH and basically any protocol thats not https "with no one noticing" because 99.9+% doesnt use it.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#49

Post by catlifeonmars »

nofunsir wrote: post #16
catlifeonmars wrote: post #5

Earlier quoted context omitted.

What would you reach for out of curiosity? For me RTP+rateless erasure codes come to mind, but I’m feeling Rube Goldbergy today.

IP over Avian Carriers

I love the fact that this is a thing.
Post reply on HN