Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I am at work we have very tight firewalls, as a way to get around them and perhaps even gain some increased anonymity myself and many of my co-workers have set up SSH tunnels to our own hosted external Linux machines and use them as SOCKS proxies.

The most rudimentary setup might look like this, although some people have slightly more complex or simplified setups:

localhost SOCKS proxy -> SSH tunnel -> sshd on port 443 -> internet

SSH is listening on port 443 because outgoing requests on port 22 are blocked.

For those interested some people use stunnel but most people are using plink invoked like this:

plink.exe -N -D localhost:7070 -l user -pw password -P 443

My question is, what does network traversing this tunnel look like to a network admin at our company? Does it merely look like "far too much ssh based traffic on port 443" which might rouse some suspicion, or can they actually see the nature of the requests?

What level of anonymity am I getting through this method, is there a better way?

share|improve this question

closed as off topic by Shane Madden, EEAA, voretaq7 Apr 12 '12 at 18:38

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Policy circumvention questions are off-topic. – EEAA Apr 12 '12 at 18:29
@erika its not a question about how to circumvent policy, nor is there necessarily a policy in my workplace about doing this - its a question from a technical perspective about what the traffic looks like. – WerkkreW Apr 12 '12 at 18:32
Well there's a reason those "very tight" firewall rules are in place. You are trying to circumvent those rules. Technical merits of your question aside, you're trying to circumvent policy. As such, it's off-topic. – EEAA Apr 12 '12 at 18:40
@WerkkreW Though this reeks of policy circumvention I actually closed it because you are not the network administrator for the environment in question - If there's really no policy in place that you're violating you can ask your netadmin to show you what the traffic looks like (and if you are in fact violating a policy by bypassing the firewall rules they can beat you appropriately) – voretaq7 Apr 12 '12 at 18:42
...or just ask them to un-block the sites you need to do your job. – EEAA Apr 12 '12 at 18:42
up vote 2 down vote accepted

They can't see what you are doing, but they can see how much you are doing something. This means that if you start downloading a file, they will not see where you are getting the file from, but they will see that there was a spike of traffic for your SSH connection.

However, do not forget that they might still see the websites you are visiting if you do not find a way to tunnel your DNS requests too. By default you will not ask this through the tunnel. SSH does not support UDP to be tunneled. So they still might see the your DNS requests. However there is a workaround for this.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.