0

When I am at work we have very tight firewalls, as a way to get around them and perhaps even gain some increased anonymity myself and many of my co-workers have set up SSH tunnels to our own hosted external Linux machines and use them as SOCKS proxies.

The most rudimentary setup might look like this, although some people have slightly more complex or simplified setups:

localhost SOCKS proxy -> SSH tunnel -> sshd on port 443 -> internet

SSH is listening on port 443 because outgoing requests on port 22 are blocked.

For those interested some people use stunnel but most people are using plink invoked like this:

plink.exe -N -D localhost:7070 -l user -pw password -P 443 remote-server.com

My question is, what does network traversing this tunnel look like to a network admin at our company? Does it merely look like "far too much ssh based traffic on port 443" which might rouse some suspicion, or can they actually see the nature of the requests?

What level of anonymity am I getting through this method, is there a better way?

6
  • 3
    Policy circumvention questions are off-topic.
    – EEAA
    Apr 12, 2012 at 18:29
  • 1
    @erika its not a question about how to circumvent policy, nor is there necessarily a policy in my workplace about doing this - its a question from a technical perspective about what the traffic looks like.
    – WerkkreW
    Apr 12, 2012 at 18:32
  • 1
    Well there's a reason those "very tight" firewall rules are in place. You are trying to circumvent those rules. Technical merits of your question aside, you're trying to circumvent policy. As such, it's off-topic.
    – EEAA
    Apr 12, 2012 at 18:40
  • 1
    @WerkkreW Though this reeks of policy circumvention I actually closed it because you are not the network administrator for the environment in question - If there's really no policy in place that you're violating you can ask your netadmin to show you what the traffic looks like (and if you are in fact violating a policy by bypassing the firewall rules they can beat you appropriately)
    – voretaq7
    Apr 12, 2012 at 18:42
  • ...or just ask them to un-block the sites you need to do your job.
    – EEAA
    Apr 12, 2012 at 18:42

1 Answer 1

2

They can't see what you are doing, but they can see how much you are doing something. This means that if you start downloading a file, they will not see where you are getting the file from, but they will see that there was a spike of traffic for your SSH connection.

However, do not forget that they might still see the websites you are visiting if you do not find a way to tunnel your DNS requests too. By default you will not ask this through the tunnel. SSH does not support UDP to be tunneled. So they still might see the your DNS requests. However there is a workaround for this.

Not the answer you're looking for? Browse other questions tagged .