Getting around the "appearance" of port forwarding?

[Brent94Z]

Hey Guys!

Title is a little weird but basically what I'm trying to do but have been unable to figure it out

Here's the deal... I work at a large company and they recently did some big changes to their proxy stuff and what they allow us to see external to the company network. Like right now I'm typing this while on break and I have no problem getting to this webpage to type this post. However, anything with "gun" anywhere in the title you can forget about it. That's fine but what else they did with their big update, is I'm now prevented from accessing anything on my home network. I used to be able to use PlaceShifter. I used to be able to log in and see my DVR and cameras. I used to be able to log into the Sage mobile menu and not watch my recordings but set some as watched, etc. Now, I can do NONE of that. The DDNS that I used for my security camera DVR no longer works and typing in the actual IP address with the port (like xxx.xxx.xxx.xxx:125) no longer works either. What I'm thinking is happening is they are blocking anything that has a colon and port.

I have a couple parked domains and have even tried using one of those and an htaccess 301 redirect when I type in my domain name to redirect to my sage server. Well, the redirect works but then fails when the address bar changes to the ip and port. I even tried a htaccess thing that was supposed to keep the original url you typed even after it fowarded (think it would keep the www.mysite.com) but it didn't work either.

Do any of you guys know if it is possible to access my sage server externally without it appearing like I'm accessing a port (using a colon in the web address)? Can there be something done in my router I wonder if I use one of my parked domains? (D-Link DIR-655) I could probably do it if I setup a web server at my home but would prefer not to do that. I know how to setup port forwarding and stuff like that but am no expert and this one has me stumped

Thanks!

[reggie14]

My guess is that they've heavily locked down the outbound ports on their firewall (in addition to some basic content filtering). Presumably they've kept outbound 80 and 443 open for HTTP and HTTPS, respectively, but that's probably about it.

In that case, your options would be pretty limited. If your ISP doesn't block inbound port 80 and 443 (many do), you could move a couple services to those ports (you may need to run HTTPS on port 443, depending on what kind of network monitoring your workplace is doing).

I'm guessing installing software at work isn't an option. If they're locking down outbound network access they probably don't want you installing software.

[Brent94Z]

Thanks for the reply! Oh yeah, it's heavily locked down now and you are correct, no software installation is allowed.

Way back in the day I did run a web server out of my house. I do keep a few computers on 24/7 right now (yeah, I know... eating electricity) so installing web server software on a computer is an option even though I'd prefer to not do that but, really, what's the harm I guess?

I seem to recall I had like 5 web pages I hosted and depending on the url address typed in depended on which folder was accessed for the index.htm web page.

So do you think it would work to direct port 80 to one of my computers that is on 24/7 then from that computer/now web server, direct it to my Sage server with the port??? When I hosted the 5 web pages before, they were all located on the computer that port 80 was directed to and based on the web address that was typed in determined what folder was used to show the index page. Where this would be different is rather than just have the traffic go to a folder on that computer, could I redirect it again to another computer IP address with the port number? Hmm??? Ideally I would like to have one of my parked domains go to my Sage server and another go to my camera DVR.

Thanks!

[stanger89]

If I could be the wet blanket for a minute, it's quite likely that attempting to circumvent the firewall will be some violation of corporate policy and could land you in hot water. They put those rules in place for a reason, and activity trying to work around them will likely appear suspicious/nefarious to your security folks.

[nyplayer]

Originally Posted by Brent94Z

Thanks for the reply! Oh yeah, it's heavily locked down now and you are correct, no software installation is allowed.

Way back in the day I did run a web server out of my house. I do keep a few computers on 24/7 right now (yeah, I know... eating electricity) so installing web server software on a computer is an option even though I'd prefer to not do that but, really, what's the harm I guess?

I seem to recall I had like 5 web pages I hosted and depending on the url address typed in depended on which folder was accessed for the index.htm web page.

So do you think it would work to direct port 80 to one of my computers that is on 24/7 then from that computer/now web server, direct it to my Sage server with the port??? When I hosted the 5 web pages before, they were all located on the computer that port 80 was directed to and based on the web address that was typed in determined what folder was used to show the index page. Where this would be different is rather than just have the traffic go to a folder on that computer, could I redirect it again to another computer IP address with the port number? Hmm??? Ideally I would like to have one of my parked domains go to my Sage server and another go to my camera DVR.

Thanks!

It seems that you are risking your job and chances are the moment you bypass the ports your company will know.

[dinki]

I'd like to echo what the other guys have said. It's not worth your job. Just turn off wifi on your phone when you want to do those sorts of things and just use your phone's data plan then get back on wifi when you're done.

[stanger89]

I will throw out there, that if you just want to access the webserver, you should be able to enable SSL and use the regular https port 443, and if they're not whitelisting IPs/domains (which it sort of sounds like they are), that should just work.

[wayner]

My company did something similar a couple of years ago and it is quite annoying on both the port blocking front and the content filtering as it can block you from getting at sites that you need for your job occasionally.

There can be a couple of options to get around this - one that was already mentioned. By the way, I am guessing that you have always been hosting a web server as the SageTV web ui is essentially a web server running through Jetty. It normally uses port 8080 and my company does allow port 8080 through as well. If you know the IT guys at your company you might want to ask which ports are allowed.

Does your company have a guest Wifi network that isn't connected to your LAN? If so then you could connect a laptop, tablet or phone to that and try Placeshifter as it is likely not locked down to the same extent as the corporate LAN.

Another thing that you could try, but which is a bit more work, is to install a proxy server at home and use this to access content but it likely will be blocked as well and it may not work for stuff like streaming video. I tried this but it was blocked by my company. Essentially this would use your home network to reroute everything to go through port 80 and a web browser.

And then there is the option, already mentioned, of just using the LTE network for stuff like Sage. But that can chew up large amounts of data if you do it very often.

On a related note, although this is unlikely to help your specific problem, I find it useful to have OpenVPN running on my router so that I can consummate a VPN connection to my LAN. This can help to troubleshoot SageTV issues when not at home, as you don't need to do port forwarding. And it also lets you access other things on your LAN that may not normally be accessible over the internet.

[Bagal]

What you're talking about doing is a reverse proxy, so that everything either goes over port 80 or 443 and is then routed internally to the appropriate server/port.

This is how I've got things setup for Sage, security cameras etc. so in my browser I just put sage.mydomain.com and the reverse proxy routes that to my Sage server or I put in security.mydomain.com and it goes to BlueIris that I use for the IP cams.

I use IIS for the reverse proxy as I already had it setup to run a couple of websites anyway, this runs in a VM, Sage itself runs on the host. I've also setup SSL certs using LetsEncrypt so everything runs over HTTPS.

I've never run Placeshifter this way, so I don't know if it would work but I don't see why it wouldn't.

As long as you're running everything over port 80 or 443 I don't see how that would be in breach of company policy.

[reggie14]

Originally Posted by Bagal

As long as you're running everything over port 80 or 443 I don't see how that would be in breach of company policy.

That seems like an overstatement... If you have a fairly allowing personal-use policy at work, you're probably safe accessing personal web sites. But, I wouldn't necessarily extend that to other services.

[Bagal]

Originally Posted by reggie14

That seems like an overstatement... If you have a fairly allowing personal-use policy at work, you're probably safe accessing personal web sites. But, I wouldn't necessarily extend that to other services.

Let me rephrase then, if you're running your own personal sites, such as Sage, over 80 or 443 and those sites don't themselves allow you to access restricted content, then all should be right with the world!

Of course, if you're working for a company that is hell bent on restricting everything, imo, that company isn't worth working for, but then that's probably why I work for myself!

[reggie14]

Originally Posted by Bagal

Let me rephrase then, if you're running your own personal sites, such as Sage, over 80 or 443 and those sites don't themselves allow you to access restricted content, then all should be right with the world!

Sure. If you stick to HTTP and HTTPS sites, you should be fine. But if they're going to the trouble of blocking other protocols, I wouldn't try to bypass that by routing the Placeshifter over port 80 or 443. An IDS would likely flag that.

[stanger89]

Yeah, I've seen running SSH (port 22) over telnet (port 23) flagged.

[will]

Just guessing here but since you work for a large company they probably don't actually open up ports 80 or 443 or anything that we typically do with our home equipment.

Most large companies setup an "air gap" between their networking equipment and then force all internal connections to go through a single server that then accesses the internet. This single server (or network appliance) can be accessed through either a proxy or NAT configuration (I'm guessing probably NAT in your case). The reason why they do this is because that single server becomes the content filter, logger on employee traffic, and the "man in the middle" to break SSL encryption. I would be surprised if this server didn't do deep packet inspection and prevents things like VPNs even if you are going over port 80/443.

By the way, if you want to know if your company does deep packet inspection on encrypted connections then check if your phone/laptop have a custom root certificate from your company installed on it; this usually indicates "man in the middle' attacks.

I've worked for companies before that have done stuff like this and, in my humble opinion, it is indicative of a bad company. Work shouldn't feel like jail and the company should treat their employees like adults.

I would not recommend using company assets (internet, computers, company phones, printers, etc.) for ANYTHING other than work. If you must access sites and such on personal time then use your phone or bring a laptop and tether your phone to it. I know that sounds extreme, but unless you work in a secure industry, like for a defense contractor, there aren't many good reasons for companies to setup restrictive systems like this. So this setup probably indicates that your company has a rambunctious IT department and a non-tech savvy management. If IT catches you getting around their systems they will scare management into terminating you; it's just not worth the risk.

[wayner]

Originally Posted by will

By the way, if you want to know if your company does deep packet inspection on encrypted connections then check if your phone/laptop have a custom root certificate from your company installed on it; this usually indicates "man in the middle' attacks.

Do you mean a personal phone/laptop or a company issued phone/laptop?

[reggie14]

I somehow doubt they're running a TLS MitM proxy. The easiest way to check, though, isn't to inspect the trust store. Just go to a couple HTTPS-protected websites and inspect the certificate from the browser. The certs used by a MitM proxy should immediately look suspicious. For one, they probably are signed by a root CA. Two, the CA name will probably look extra weird.

[Brent94Z]

Thanks for all the replies and concerns, guys!

I'll go through the technical stuff here in a bit.

I do appreciate the heads up and concern on what the company might think. They do take seriously people attempting to bypass sites that are blocked and monitor all internet activity (probably this too!). However, this I don't view the same as trying to bypass their blocks to say, access an adult site. That is specifically blocked content. Whereas my personal computer isn't specifically blocked because they are trying to specifically block me from getting to that specific IP address. Also, I'm sure that many sites that aren't blocked and acceptable do the same thing that I'd like to do in that once you access a certain IP address it directs you to a different computer on that IP address. Oh, another reason why I view what I'd like to do as not being an issue for my company is that when we try to access a site that is specifically blocked, we get a web page that shows that it has been blocked by the company proxy server and the reason why it was blocked. When I try to access my home IP address I don't get that specific message... I just get a Chrome error message that the connection timed out or something like that. If I were to get the web page with the specific reason why my home network that I was trying to access was being blocked then, yes, I think that would be a different story!

Doing this is definitely not worth my job! Using the internet for personal use during periods when we aren't doing a specific job is perfectly acceptable and allowed by company policy. There is nothing in the company internet usage policy that disallows accessing DVRs or personal security systems or home networks or anything like that. I believe it is HOW I am trying to access it that doesn't work due to some "global" setting so I'm just wondering how to access it using a method that is allowed.

[stanger89]

Originally Posted by Brent94Z

Thanks for all the replies and concerns, guys!

I'll go through the technical stuff here in a bit.

I do appreciate the heads up and concern on what the company might think. They do take seriously people attempting to bypass sites that are blocked and monitor all internet activity (probably this too!). However, this I don't view the same as trying to bypass their blocks to say, access an adult site. That is specifically blocked content.

You may view it differently, but from they other side they may not. Companies put these thing up for two primary reasons, to prevent bad things getting into the network, and to prevent sensitive information from getting out. If they see an employee going to "great lengths" to connect to an un-vetted site, how do they know it's not espionage? They're going to have to assume the worst. Hopefully (for that employee) they'll issue a warning first, but they really don't have to.

[will]

Originally Posted by wayner

Do you mean a personal phone/laptop or a company issued phone/laptop?

It would definitely be on a company laptop but it may also be on a personal laptop or phone. For example, the last company I worked for required you to installed MaaS360 Mobile Device Management software in order to connect to the company WiFi or access MS Exchange email accounts with personal phones. Anyone in the 12,000 person company was welcome to connect to the "free" WiFi as long as you agreed to install MaaS360. The software had a few creepy factors to it; like reporting to IT all the Apps you have installed and your GPS location.

The iOS software would also install a custom profile that would install company root certificates so they could perform SSL inspection of traffic or man-in-the-middle attacks. IT logged every website, how much time you spent on the internet, everything you ever printed, and performed deep packet analysis looking for things like financial data or SSN numbers. For example, if I uploaded an excel spreadsheet outside the network with SSN numbers, in theory at least, the deep packet analysis technology should have prevented the upload and alerted the security department. I'm not sure how well the deep packet analysis technology worked but the company invested a lot of money in it so I wouldn't be surprised if it worked really well.

Originally Posted by reggie14

I somehow doubt they're running a TLS MitM proxy.

Five or ten years ago, I would probably agree, but not today. The technology has become available even with small business routers. A $650 small business router (ZyXEL USG 100) performs SSL inspection (MitM).