Firewalls that block RDP over port 443

Question

I need people to reach my servers over SSH and RDP. Both ports are blocked outbound at many companies, especially the large ones. However, I also suspect that in 90% of companies there is nothing to stop tunneling SSH and RDP outbound over port 443. Ignoring the security concerns of that, I am wondering:

1) How many of you can tunnel RDP over 443 at the companies you've worked at [let's not discuss current companies for username protection]?

2) If you can't tunnel RDP, then do you know what's blocking it. Is it the firewall or some other specialized security box at the perimeter?

Answer 1

Many companies block the CONNECT method, and the IP connections (without dns name). That's especially useful for blocking Skype.

Answer 2

In my experience it's fairly rare for ports 80 and 443 to be restricted, unless the companies have really skimped on their IT and implement security via clubbing (or have a specific need for extra security).

No matter what you do, you'll find places that block the connection. Are you trying to let customers in or members of your staff? If it's your own staff, I highly suggest looking into cellular access cards or similar.

Answer 3

You don't need to tunnel per se, you just need to port forward, although your limited to either RDP or SSH if you only have 443 available. Most companies keep port 80 and 443 open to the world.

For example, setup your firewall/router on the RDP/SSH end to forward any incoming requests to 443 to your windows server on 3389 or to your SSH server on 22. If you have nothing using port 80 on your server's end, you can use both 443 and 80 for RDP and SSH, just setup 2 rules.

If you want to get fancy, you can setup your Linux machine on 443, and use SSH tunneling to get to anything, including RDP! For example, on your local machine:

$ ssh -L 9999:ANYIP:ANYPORT --port 443 user@REMOTEIP

This is for a local Linux/Mac machine (use PuTTY for Windows). Then any connections to localhost on port 9999 will be forwarded (and encrypted) to ANYIP on port ANYPORT.

A little complicated, but powerful. Hope this helps!