Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have my router at home running Tomato USB with OpenVPN running on port 1194. The campus network only has port 80 publicly open and I'm almost positive that they do traffic shaping and content filtering. Is my only option here to change the port OpenVPN is running on in Tomato USB to port 80 and connect from the campus within the client from port 80?

share|improve this question

migrated from serverfault.com Apr 11 '11 at 21:36

This question came from our site for professional system and network administrators.

2  
You can certainly try, however, based on what you said, they probably inspect HTTP packets, which VPN traffic is NOT. –  Vick Vega Apr 11 '11 at 21:13
    
Thanks, I think I will definitely give it a try this week. –  Aaron Apr 11 '11 at 22:49
    
does your ISP have port 80 open tho? many ISPs block it –  Journeyman Geek Jul 7 '11 at 23:52
add comment

2 Answers

up vote 1 down vote accepted

Not making advertisement, but in my campus SwissVPN service (which runs OpenVPN) works fine because that guys configured the OpenVPN server to accept connections on port 443 (often used for HTTPS) and since the OpenVPN socket is SSL layered, to the stupid firewall in my campus it's like I'm doing HTTPS with some server.

HTTPS is not distinguishable from anything else running on a SSL enforced socket. Some poor firewalls assume SSL on 443 == HTTPS.

Try it out (setting your own VPN server on port 443 or try SwissVPN free test), it might work.

If it doesn't work and you have much spare time, you can try to find some HTTP tunneling tool but it's not clean as OpenVPN.

share|improve this answer
2  
@Aaron Port 443 isn't open? What do they do when users need to access HTTPS sites?? –  Kromey Apr 11 '11 at 21:46
2  
I'm a bit confused by your answers, or you're messing up with the concept of 'open ports'. It's obvious that you can't accept inbound connections from inside your campus network without a tunnel, to any port of yours. But you can establish outbound connections, to some ports of other servers on the Internet. It's not your 443 port being open, it's just: "outbound connections to port 443 of OTHER hosts are allowed". It's different! More, if your home router doesn't accept inbound connections, then the problem has NO solution unless you use a third node. –  gd1 Apr 12 '11 at 7:48
1  
As a server, you need inbound access. As a client, you need to perform an outgoing connection to a certain port of a properly configured OpenVPN server. It's a classic client-server design. If this port is 443, OpenVPN can mimic HTTPS, being almost undetectable by many corporate firewalls. Some other firewalls are more clever and will break the pipe between client and server, basing on the fact that "no HTTPS connection is sometimes idle for 10 minutes!", so you'll have to reconnect every n minutes or go for a different solution (I had fair results with HTTP 'segmented' tunneling - slow) –  gd1 Apr 16 '11 at 21:55
1  
I know it's been a while, but I forgot to mark this answer as the best answer. I also wanted to let everyone know that I just had to change the port OpenVPN was using to 443. After doing that, everything worked fine. –  Aaron Jul 8 '11 at 2:40
1  
Glad to hear. SSL on port 443 is the main flaw of every corporate firewall (as of outgoing connections) –  gd1 Jul 8 '11 at 22:15
show 9 more comments

Personally, I prefer to run WinSSHD on my pc on campus (on port 80 rather than 22) and then open a tunnel from the outside using Tunnelier client. Then, map ports as needed to tunnel through. This isn't a VPN and so you have to manually map ports... things aren't wide open like on a VPN connection. Just an idea in case your VPN method doesn't work.

share|improve this answer
    
Thanks for your idea. I was actually able to get OpenVPN up and running. The main issue was that my school blocks so many outgoing ports, and one of them happened to be 1194. Changing the server on the router to listen on port 443 and connecting via port 443 did the trick. –  Aaron Jul 8 '11 at 2:38
    
You aren't connecting via port 443, you're probably using a random port... The server listens on 443 :) –  gd1 Jul 8 '11 at 22:15
    
Quick question. Let's say I am connecting to an SSH server on some server that's running it on port 22. When I try connecting to an SSH server running on my VPS or even when trying to connect to Github (from the campus), it's blocked. Now, what I have done is change my VPS's SSH server to listen on a completely different port which allows me to connect from campus. If I am connecting to that different port on my VPS but am most likely using a random port on my machine on campus for the outbound connection, what would be stopping all outbound connections to port 22? Can firewalls prevent that? –  Aaron Mar 22 '12 at 15:59
    
Most networks are configured to allow outgoing ports. For example, web browsers use the 3000 range for returning connections. It is possible though that firewalls can block traffic based on protocol type rather than by port. –  djangofan Mar 22 '12 at 17:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.