Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How to use SSL tunnelling to give full internet access to some applications while you are on a restrictive corporate network?

Use cases:

  • you want to be able to access some restricted destinations and/or ports with some applications from your computer but you are on a restricted network (corporate) - Even using a Torrent client.
  • you have an AWS machine running Ubuntu that you can use as a proxy (and you can SSH to this machine)
  • You cannot create a full VPN because this means that you will loose access to your intranet and you do not want that.
  • A HTTP proxy would not work

The big question is on client side: how to configure this to make it work?

Currently I am looking for a solution for OS X desktops.

share|improve this question
    
Note that a VPN not necessarily prevents you from using the corporate network - that is a matter of configuration. Usually you can configure a VPN to route only selective IP addresses/networks through the tunnel. –  Robert Jul 26 '12 at 13:26
add comment

1 Answer

Set up a passphrase protected proxy on an SSL-secured (Apache-) webserver under your control. A dynamic IP should be sufficent for this (at your home location).

  • Passphrase (or Client Certificate) protected so no one can misuse your proxy.
  • SSL so no one can sniff your traffic (maybe use a CACert.org Cert)

If your IT gets suspicious you could also only open the proxy function when a special HTTP header of your choice is set and otherwise just show innocent content.

Some nice article (translated from german though) can be found here

share|improve this answer
1  
Just because you are using SSL at work, doesn't mean no one can sniff your traffic. Many companies routinely run SSL interceptors. Dump the SSL certs for the server from home and from work, and only use SSL at work if the certs are the same. If the cert is different when fetched from work, you are being intercepted. –  Fran Jul 20 '12 at 14:15
    
You can only intercept SSL traffic if you own one of the CA's that is trusted by the user's browser. If the company you work at has screen recorders installed on your workstation, you're hosed either way. PS: Both ssl and screen recording is illegal here for most cases (Germany). Client certs or a Strict-Transport-Security header might also be a way to improve that. –  ce4 Jul 20 '12 at 14:57
    
Yes, and SSL interceptors work because they run transparent proxies that route your TCP connection to a local server that offers a cert signed by a company-generated CA cert that has been inserted into your work machine's browser by the IT department. That server decrypts your SSL traffic, scans it, and forwards it on to the external server (again using SSL). It's a classic MITM attack. –  Fran Jul 20 '12 at 15:00
    
Correct. I know that. Sorry for not pointing it out better, it's uncommon here. I only know of the BSI that do it here, thats however a state agency that's allowed to do that. PS: Chrome does hardcoded checks for certain CAs for google sites and a bunch of others. Can be seen in the source –  ce4 Jul 20 '12 at 15:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.