IP traffic over ICMP tunneling • Hacker News Board

Re: IP traffic over ICMP tunneling

#81

Post by vesinisa » Thu, Nov 12, 2015, 1:00 PM UTC

1lann wrote: post #78

vesinisa wrote: post #47

A few years back, I was assigned to work at a BigCorp's premises. They had really tight network security: all outward connections were blocked except through a dedicated HTTP proxy. This was bad news, since stuff like SSH are absolutely essential in my job. After few days of mobile tethering, I realized I could ask their HTTP proxy to open an HTTPS connection to a server outside the network, but instead of sending HT…

My school blocks all protocols except for HTTP and HTTPS. However they actually MITM HTTPS connections (I have to install a root certificate from them) so they can decrypt and see everything people do. So unfortunately typical TCP proxies don't work, even on port 443 as their transparent proxy makes the handshake. Instead, I have to put the payload in an HTTP request acting as a download, and another request as an up…

That should be criminal, requiring users to install a root cert is just sad.. nice workaround though!

Re: IP traffic over ICMP tunneling

#82

Post by vesinisa » Thu, Nov 12, 2015, 1:02 PM UTC

Laforet wrote: post #74

andrewchambers wrote: post #72

Earlier quoted context omitted.

Blocking based on port is a silly thing. He probably just ran ssh on port 443 to get around it.

That's another possibility, the comment above can be interpreted either way. In any case they were probably running something like squid with very basic level 7 filtering, so if something comes on 443 they have no option but to forward it.

I think they allowed HTTP CONNECT to any port. Not that it would have been hard to move OpenVPN or SSH to a different port.

Re: IP traffic over ICMP tunneling

#83

Post by vampire_dk » Thu, Nov 12, 2015, 2:18 PM UTC

redwards510 wrote: post #36

The documentation for this is superb! I know what it does, why I'd want to use it, how to use it, where to use it and what it looks like in wireshark. Well done!

Thanks for the feedback :)

Re: IP traffic over ICMP tunneling

#84

Post by level3 » Thu, Nov 12, 2015, 4:21 PM UTC

hrez wrote: post #80

Laforet wrote: post #55

Earlier quoted context omitted.

I have been using it since its early releases in 2003 and the feature set really reflects the continuous development.

I hope you meant 2013. Looks like the earliest beta users were starting 2012.

Before SoftEther went open source, it was sold commercially as early as 2004. It was renamed PacketIX VPN around 2005 and is still sold commercially under that product name at https://www.softether.jp/1-product/11-vpn (it's up to v4.0).

I remember reading that there was a 10-year agreement that finally ended at the start of 2014, allowing the original developer to go open source. The source tree is different from PacketIX's though, so some of the features are still not available yet in the open source version.

Re: IP traffic over ICMP tunneling

#85

Post by scurvy » Thu, Nov 12, 2015, 4:52 PM UTC

burkaman wrote: post #48

scurvy wrote: post #23

Earlier quoted context omitted.

Out of curiosity, why would you drop echo requests or replies? I know the normal thought is "So no one will know if the IP is in use or not," but that argument doesn't hold water. Scanning toolkits have been fast enough for the past decade to skip ICMP altogether. They know you're home even with ICMP blocked. Edited for spelling

They said they only allow echo and reply, not drop them.

That's even worse. PMTU detection is OK but not perfect. Fragmentation needed but DF bit set ICMP messages are important.

Re: IP traffic over ICMP tunneling

#86

Post by fl0m » Fri, Nov 13, 2015, 11:32 AM UTC

Using ICMP reply only in both side is more convinient than ICMP reques/reply. In this case you do not need to write this, for example echo 1 | dd of=/proc/sys/net/ipv4/icmp_echo_ignore_all