Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 4 down vote favorite

Alright so my work blocks a bunch of websites for obvious reasons. They even blacklisted logmein.com so thats out. I feel that I am capable of getting all my work done AND keeping up with my warfish games once in a while...

I set up a few remote management sites on my home pc for access from work. I have my torrent webui, an ftp site, and remote router management all accessible on different ports and using my no-ip address. All of those sites I can access and play with at my leisure from my corporate pc. I added an app to the list and set up a web proxy (phproxy), but I'm getting smacked with "Access Denied: Proxy Avoidance" when I try to use it. Its obviously determining this from the content of the script or the type of response its getting from the site. I've even tried hosting my web proxy on port 80 to see if it was related to suspicious port communication, but I got the same message.

So my question is, how is the firewall picking up on that? Is there something I can change in the php to counter that? Is there a different protocol/platform I can use for a web proxy that will [probably] get by the filter?

UPDATE:

I have come to the conclusion by the advice of those of the Superuser and Server Fault community that my efforts are a direct violation of company policy and is frowned upon (to put it nicely). I have abandoned my efforts and am now an advocate of working WITH the company rather than against it. I came from years of working for startup companies which had no such policy and I have recently been caged up into a structured, secure environment... I even have to wear dress pants :( I appreciate everyone's advice, especially those who just said "don't do it" in a polite way.

share|improve this question
I didn't tell you not to do it, I told how to do it the_right_way. TM ...You might read my answer below... RT – Richard T Jan 24 '10 at 4:51

8 Answers

up vote 1 down vote accepted

My suggestion is still create a VPN network at home, and connect from the office. At the very least you could then RDP into your home box and browse as if you were on your home computer.

My guess is that the corporate filter is blocking traffic it thinks is disguised, and will look for keywords such as proxy and long urls after generic sites. Example: www.home.com/index.php?id=2309324230842303984320948230982039 where the id is a base_64 encoded version of the requested url or something.

share|improve this answer
up vote 5 down vote

If you are running an SSH daemon at home, you can create a SOCKS proxy, and send your traffic through that. This will also work for other programs, such as instant messaging (using pidgin) skype, and may others.

If you are using SSH (form work) from the command line, connect using the following command:

ssh -D 1080 yourhome.no-ip.com

If you are using Putty or some other SSH client from work, then you will have to dig through the options to set up the SOCKS proxy (it may also be called a Dynamic proxy).

Then, set your applications (Firefox, skype, etc) to use a SOCKS proxy running on port 1080 on localhost.

Keep in mind, though, that doing this is most definitely violating your company's AUP, and you could get in trouble (including termination) for it.

share|improve this answer
1  
And detecting an SSH tunnel is a very basic capability for traffic filtering systems, if they're finding phproxy in a URL then it's unlikely that they'd fail to notice an SSH session. +1 for the AUP though - deliberately bypassing legitimate access controls is a firing offence in most places, no matter how pathetic the restrictions may seem. – Helvick Jan 19 '10 at 23:02
I don't see how having an SSH connection open is grounds for termination, There are completely legitimate reasons to have an SSH connection open. For example, I mount remote file systems using ssh connections at work all the time. I use a SOCKS proxy more for my personal privacy then for getting around firewalls. – Bill Casarin Jan 22 '10 at 13:47
Having an open SSH connection may not be grounds for termination, but circumventing the firewall would probably be. Of course, it depends on the company's individual policies. Also, @Helvick, I'm curious how they would detect a person running a Dynamic port forward though an SSH connection. I thought all SSH traffic was encrypted, so how does the traffic look different from any other SSH traffic? – pkaeding Jan 22 '10 at 16:15
you're absolutely correct there is no way to analyse the content but SSH traffic itself would not be considered normal coming from a user workstation in a typical end user environment. Given it's potential for enabling arbitrary tunnelling any organisation that actively suppresses personal proxies should actively lock out unknown SSH traffic too. Whether many companies do or not I've no idea, I know that I worked for one that did. – Helvick Jan 22 '10 at 18:59
@Bill - depending on the user environment you are correct but the idea that an arbitrary user should be allowed to mount an external filesystem through a corporate firewall would give most IT Security departments serious heartburn. That said the same applies to SSL tunnelling and stopping that is much harder. – Helvick Jan 22 '10 at 19:10
up vote 2 down vote

This really isn't the forum for these kinds of questions. Most of the people here are the very people trying to keep you from bypassing security measures.

share|improve this answer
3  
On the one hand, I WANT the inside view on what my users might be up to. But I'm probably not going to go out of my way to help them. It'll be interesting to see how the posts/votes fall. – Kara Marfia Jan 20 '10 at 19:53
4  
I know I would make that users life a bit more miserable if I found out about it. – Dan Jan 20 '10 at 20:00
@Kara: In my experience, proxy and firewall logs have given me all that I need to know in order to determine what users are up to. – squillman Jan 20 '10 at 20:10
1  
@Kara: I used to work with you at ES3 in the Detroit area. Hi! – Honus Wagner Jan 21 '10 at 13:30
up vote 2 down vote

Would you really risk losing your job trying to accomplish this? It is a valid question, but you are you using their network and resources. They can control the network in any way they feel benefits the company work flow. Personally, I cannot see why someone would risk their job trying to check some game status. You do not want a network administrator throwing down a log of your account/computer access to HR or your boss.

My suggestion, buy a personal smart phone/laptop/netbook with a data plan for all your personal needs. You would not be limited by any firewall or company resources and reduce your chances of causing a stir.

share|improve this answer
up vote 0 down vote

Web filtering normally works based on the url. If you've got a file called proxy.php or a folder called /phproxy/ then it's going to catch those. If there are no keywords in any of the URLs, then it could be looking at the page title - it's unlikely that it's trawling the whole page.

If you run it as a secure (https) website, then all they have it the URLs, they can't see any of the other content, and thus can't block it unless you have suspicious paths.

share|improve this answer
The url is clean, and I've changed the title of the page, so its not that. I've also had no luck connecting via HTTPS since I've set it up on my WAMP server at home. – Honus Wagner Jan 20 '10 at 15:40
up vote 0 down vote

Well there's always somebody that believes the rules don't apply to them, that they are special and unique, that they're somehow above the rest of us sheep, and that they should be able to do what they want when they want to do it.

"Don't tase me, bro!"

share|improve this answer
Hahaha, I forgot about that guy. – squillman Jan 20 '10 at 20:16
up vote 0 down vote

Well, you could VNC into your home box and just use your home webbrowser.

It's not going to be fast, though.

share|improve this answer
up vote 0 down vote

Here's the right way!

THERE IS ALWAYS A RIGHT WAY!

...Go to your boss and convince them you need such access. Make him / her a deal; if you aren't getting your job done to their satisfaction, you'll give it up. If you're smart, you'll plan a way to make it VERY easy on the company's administrators. Also, if you're smart, your boss might want to keep you.

Once you have permission, work WITH your company's support staff to plan the best way to keep them from having problems because of you.

.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.