71–80 of 86 posts
Earlier quoted context omitted.
With even ICMP you can send/receive large messages. There is no restriction on the maximum payload length.
Normally, an ethernet or wifi restricts an MTU of 1500. I use ping packets accordingly
A few years back, I was assigned to work at a BigCorp's premises. They had really tight network security: all outward connections were blocked except through a dedicated HTTP proxy. This was bad news, since stuff like SSH are absolutely essential in my job. After few days of mobile tethering, I realized I could ask their HTTP proxy to open an HTTPS connection to a server outside the network, but instead of sending HT…
Sounds like they enabled HTTP CONNECT without limiting the accepted port range, so any protocol will go through. Maybe this is why Microsoft Azure never allowed ICMP travseral through their outer firewall despite frequent request from users....
Earlier quoted context omitted.
I don't know about cable, but DSL usually uses PPPoE. It has on overhead of 8 bytes, lowering the MTU of those connections to 1492 bytes.
It doesn't matter the MTU setting on your end for WAN and ISP / interlink grade networks is meaningless they don't use Ethernet, FDDI frame size is 4500 (ATM is about double that) bytes (minus what ever overhead, but usually 4200 and change) ISP/WAN routers don't care about how many mbit/s they transfer but how many packets they route at per given unit of time, as packets get packed into a single frame the smaller th…
Earlier quoted context omitted.
Sounds like they enabled HTTP CONNECT without limiting the accepted port range, so any protocol will go through. Maybe this is why Microsoft Azure never allowed ICMP travseral through their outer firewall despite frequent request from users....
Blocking based on port is a silly thing. He probably just ran ssh on port 443 to get around it.
In any case they were probably running something like squid with very basic level 7 filtering, so if something comes on 443 they have no option but to forward it.
Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel Any captive portal these days block also ICMP. Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why? The only way these days is to misuse DNS. But even that works less and less reliable.
How about IP over TCP SYN.
A few years back, I was assigned to work at a BigCorp's premises. They had really tight network security: all outward connections were blocked except through a dedicated HTTP proxy. This was bad news, since stuff like SSH are absolutely essential in my job. After few days of mobile tethering, I realized I could ask their HTTP proxy to open an HTTPS connection to a server outside the network, but instead of sending HT…
A few years back, I was assigned to work at a BigCorp's premises. They had really tight network security: all outward connections were blocked except through a dedicated HTTP proxy. This was bad news, since stuff like SSH are absolutely essential in my job. After few days of mobile tethering, I realized I could ask their HTTP proxy to open an HTTPS connection to a server outside the network, but instead of sending HT…
Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel Any captive portal these days block also ICMP. Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why? The only way these days is to misuse DNS. But even that works less and less reliable.
I agree that some captive portals/firewalls do block ICMP but still I've seen many in my country which don't.
Earlier quoted context omitted.
I know among the pfsense group originally there was skepticism that it wasn't back doored by a government agency (not because there was proof), because of the fact it had such a great feature set while being so new a project. Now that it's open sourced, I'm interested to see if people pick it up. It definitely looks legit.
I have been using it since its early releases in 2003 and the feature set really reflects the continuous development.