1

I need people to reach my servers over SSH and RDP. Both ports are blocked outbound at many companies, especially the large ones. However, I also suspect that in 90% of companies there is nothing to stop tunneling SSH and RDP outbound over port 443. Ignoring the security concerns of that, I am wondering:

1) How many of you can tunnel RDP over 443 at the companies you've worked at [let's not discuss current companies for username protection]?

2) If you can't tunnel RDP, then do you know what's blocking it. Is it the firewall or some other specialized security box at the perimeter?

Improve this question
1
  • Is this RDP connection you want made to a specific server or set of servers? Setting up a terminal services gateway may help in situations where raw RDP is blocked.
    – Zoredache
    Aug 16, 2010 at 3:51

3 Answers 3

Reset to default
2

Many companies block the CONNECT method, and the IP connections (without dns name). That's especially useful for blocking Skype.

Improve this answer
1

You don't need to tunnel per se, you just need to port forward, although your limited to either RDP or SSH if you only have 443 available. Most companies keep port 80 and 443 open to the world.

For example, setup your firewall/router on the RDP/SSH end to forward any incoming requests to 443 to your windows server on 3389 or to your SSH server on 22. If you have nothing using port 80 on your server's end, you can use both 443 and 80 for RDP and SSH, just setup 2 rules.

If you want to get fancy, you can setup your Linux machine on 443, and use SSH tunneling to get to anything, including RDP! For example, on your local machine:

$ ssh -L 9999:ANYIP:ANYPORT --port 443 user@REMOTEIP

This is for a local Linux/Mac machine (use PuTTY for Windows). Then any connections to localhost on port 9999 will be forwarded (and encrypted) to ANYIP on port ANYPORT.

A little complicated, but powerful. Hope this helps!

Improve this answer
2
  • I want to avoid port forwarding as it needs a lot more technical skills and steps to make work. Hence, I'm interested solely in making RDP/SSH work, as is, over port 443.
    – TunnelDigger
    Aug 16, 2010 at 3:38
  • In this case, you'll need to have your Windows or Linux server directly connected to the net, and change the default ports they listen on. Again, since you only have 443, you can pick one or the other, but not both. For Windows, you can follow this guide to change the default port (support.microsoft.com/kb/306759). For Linux, edit the /etc/ssh/sshd_config file and change the Port setting to Port 443. Good luck!
    – vmfarms
    Aug 16, 2010 at 3:50
1

In my experience it's fairly rare for ports 80 and 443 to be restricted, unless the companies have really skimped on their IT and implement security via clubbing (or have a specific need for extra security).

No matter what you do, you'll find places that block the connection. Are you trying to let customers in or members of your staff? If it's your own staff, I highly suggest looking into cellular access cards or similar.

Improve this answer
1
  • +1 for the air cards. I always hate it when vendors want to hook into my networks...like I trust the laptop they're bringing in...especially when they unplug desktops to do so.
    – Jason Berg
    Aug 16, 2010 at 5:38

You must log in to answer this question.