4

So I'm on a public WiFi network that blocks websites like YouTube in order to conserve bandwidth. I'm assuming the router is monitoring all traffic and rejecting all requests sent to the sites on its blacklist. In order to get around this, I tried using an SSH tunnel so that I'd have an encrypted connection with my remote server and the web requests would be made from the remote server. So the router I'm connected to shouldn't have any idea what the packets I'm sending are.

I've tried this method before on other networks that filtered traffic to sites like YouTube and it has worked perfectly. somehow this router is still able to block the websites. I've checked to make sure that my traffic is really going through the remote server by verifying the IP address, so I know I didn't just mess up the settings or forget to point my browser to the correct port. I've tried routing the traffic through two separate servers, one that uses password authentication and another that only uses keys, and the traffic is filtered in both cases.

If the packets I'm sending to and from the remote server are encrypted, how can the router know that I'm trying to access YouTube? Is the router doing a man in the middle attack on me? I checked the server's fingerprint and it was the same as usual, but maybe the router can spoof the fingerprint?

I just want to understand how the router is doing this.

10
  • 16
    My first thought is a DNS leak. I would suggest you use a packet sniffing tool like Wireshark to make sure that your DNS request for youtube.com is going through the SSH tunnel and not going direct to the router and being blocked. Mar 26, 2014 at 12:11
  • @user2675345 is probably correct. Mar 26, 2014 at 12:55
  • Could also be some packet inspection engine in the works For better results, have your SSH server listen on tcp/443 :)
    – Fugunawa
    Mar 26, 2014 at 16:23
  • Perhaps it blocks all traffic which looks like "small outgoing payload - huge incoming payload coming in below line capacity" (which might indicate a streaming video)? Mar 26, 2014 at 16:45
  • 1
    You could use OpenVPN and route all traffic, including DNS, through your server.
    – gogators
    May 1, 2014 at 16:32

2 Answers 2

0

Just like @user2675345 is saying, you should probably check the DNS proxy settings if your browser has any.

Follow these steps to enable DNS lookups through a proxy in Firefox:

  1. enter about:config in the address bar
  2. search for proxy
  3. set network.proxy.socks_remote_dns to true

I used to be a Chrome user myself, but switched to Firefox when I noticed that the DNS lookups didn't use the proxy settings. That was a while ago and should be fixed now according to this bug report.

0

tl;dr: It was a DNS leak. Thanks to @user2675345 for the tip off!

Here is the page I got when I accessed a blocked site:

blocked site

I first tried pinging a few websites and saw that their IP addresses were the same. As can be seen in this image:

pings

both youtube.com and metacafe.com, which are both blocked, have 176.12.107.179 as their IP. Unsurprisingly, navigating to this IP in a browser yields the "Requested Site Blocked" page shown above. Pinging www.google.com on the other hand, results in a legit IP pointing to Google.

So the urls were getting mapped to the wrong IP. I used dig to inspect the DNS entries and confirm this.

digs

Indeed, the DNS entry for youtube.com had 176.12.107.179 as it's IP.

I then used Wireshark to check out the DNS requests and saw that the requests weren't coming from the IP of the server I was SSH'ed into, but from my local IP address.

ip trace

Even though I was using an SSH tunnel, my DNS requests were not going through the tunnel. Also, they seemed to be going to an IP address on the same network. So it looks like the router onboard the bus was acting as a DNS server and giving out bad DNS answers for sites on its blacklist.

This is a very serious vulnerability. Not only could an eavesdropper see all of the websites I was going to, but the person controlling the router/DNS server could easily route me to a malicious version of youtube, rather than to the "Requested Site Blocked" page. And ll the while, I'm thinking that my traffic is all going through the SSH tunnel and I'm completely secure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .