Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP traffic over ICMP tunneling

github.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: IP traffic over ICMP tunneling

#41

Post by cortesoft »

scurvy wrote: post #21
PinguTS wrote: post #3

Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel Any captive portal these days block also ICMP. Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why? The only way these days is to misuse DNS. But even that works less and less reliable.

Why would you block ICMP rather than police it or only allow certain opcodes and sizes? I hope the people blocking ICMP don't ever try and run IPv6.

Of course they aren't going to try IPv6. Not because of ICMP, but they won't try it.

Re: IP traffic over ICMP tunneling

#43

Post by hueving »

redwards510 wrote: post #40
NetStrikeForce wrote: post #26

SoftEther, a multi platform and open-source software supports ICMP and DNS tunnelling among other things (SSL, OpenVPN, IPsec, etc) http://www.softether.org

After reading the product page, this product seems too good to be true (OSS, supports every OS and every type of VPN). Is there some kind of catch? How come I've never heard of it until now?

It's written in C++. /s

I suspect it hasn't gotten a lot of widespread publication in English forums because it's from a University project from Japan so there aren't a lot of English-speaking contributors (there are only 9 contributors to the official repo).

Additionally, it was only open sourced in 2014 so as an open source project it's pretty young.

Re: IP traffic over ICMP tunneling

#44

Post by tw04 »

redwards510 wrote: post #40
NetStrikeForce wrote: post #26

SoftEther, a multi platform and open-source software supports ICMP and DNS tunnelling among other things (SSL, OpenVPN, IPsec, etc) http://www.softether.org

After reading the product page, this product seems too good to be true (OSS, supports every OS and every type of VPN). Is there some kind of catch? How come I've never heard of it until now?

I know among the pfsense group originally there was skepticism that it wasn't back doored by a government agency (not because there was proof), because of the fact it had such a great feature set while being so new a project. Now that it's open sourced, I'm interested to see if people pick it up. It definitely looks legit.

Re: IP traffic over ICMP tunneling

#45

Post by admin36 »

redwards510 wrote: post #40
NetStrikeForce wrote: post #26

SoftEther, a multi platform and open-source software supports ICMP and DNS tunnelling among other things (SSL, OpenVPN, IPsec, etc) http://www.softether.org

After reading the product page, this product seems too good to be true (OSS, supports every OS and every type of VPN). Is there some kind of catch? How come I've never heard of it until now?

I've deployed SoftEther and I can confirm that the software does work incredibly well and is jam packed with features.

I to was concerned with the legitimacy of the software. But it is open source now, which should aid discovery.

I don't use it anymore at the moment. But my gut feeling is it is legit software, but sometimes there is just no way to know...

Re: IP traffic over ICMP tunneling

#47

Post by vesinisa »

A few years back, I was assigned to work at a BigCorp's premises. They had really tight network security: all outward connections were blocked except through a dedicated HTTP proxy. This was bad news, since stuff like SSH are absolutely essential in my job.

After few days of mobile tethering, I realized I could ask their HTTP proxy to open an HTTPS connection to a server outside the network, but instead of sending HTTPS traffic through the proxy, I could send any traffic - like SSH. With this, I was ultimately able to open an SSH-tunnel to my own shell server running OpenVPN outside their network, which then allowed a (surprisingly stable and fast) access to the internet at wide – via an OpenVPN-tunnel wrapped in an SSH-tunnel pretending to be an HTTPS-tunnel.

I don't recall whether ICMP was allowed out at the BigCorp., but I am pretty sure someone will one day find a tool like this quite useful in a similar situation.. :)

Re: IP traffic over ICMP tunneling

#48

Post by burkaman »

scurvy wrote: post #23
txutxu wrote: post #7

I use to restrict ICMP to echo/reply using -m icmp on iptables, but this uses just that kind of packets... Is there anyway to stop things like this at the corporate firewall?

Out of curiosity, why would you drop echo requests or replies? I know the normal thought is "So no one will know if the IP is in use or not," but that argument doesn't hold water. Scanning toolkits have been fast enough for the past decade to skip ICMP altogether. They know you're home even with ICMP blocked. Edited for spelling

They said they only allow echo and reply, not drop them.

Re: IP traffic over ICMP tunneling

#49

Post by jamescun »

NetStrikeForce wrote: post #26

SoftEther, a multi platform and open-source software supports ICMP and DNS tunnelling among other things (SSL, OpenVPN, IPsec, etc) http://www.softether.org

SoftEther is an amazing piece of software. As mentioned I was a little dubious of it back when it was closed source and touted so many features. After going open source I trialled it on a small network (~40 users) and it was rock solid.

My only gripe was user management. It lacks an LDAP or PAM integration, substituting RADIUS instead. No biggy, I can set up a SoftEther->RADIUS->LDAP bridge. The caveat is that SoftEther will only apply RADIUS authentication to accounts you manually define; so you must create a user in SoftEther and enable RADIUS for them. This may have been fixed by now, but was rather annoying back then!

Re: IP traffic over ICMP tunneling

#50

Post by avar »

victorhooi wrote: post #9

For anybody that's tried both - how do these compare to DNS tunnels (e.g. iodine), in terms of speed and reliability?

By far the biggest impact on tunneling over DNS is whether or not you can make direct DNS queries to the server running iodine.

I did some tests a while and found that iodine was ~98% of non-tunneled speed when I could access the server directly, since then the traffic is wrapped over huge big TXT queries and it's really efficient.

But the common case for using it is that you can only lookup through a local DNS server, and then it's usually ~0.5% or so of the usual speed. I.e. 1-2KB/s at best.

Post reply on HN