2

I have my router at home running Tomato USB with OpenVPN running on port 1194. The campus network only has port 80 publicly open and I'm almost positive that they do traffic shaping and content filtering. Is my only option here to change the port OpenVPN is running on in Tomato USB to port 80 and connect from the campus within the client from port 80?

3
  • 2
    You can certainly try, however, based on what you said, they probably inspect HTTP packets, which VPN traffic is NOT.
    – Vick Vega
    Apr 11, 2011 at 21:13
  • Thanks, I think I will definitely give it a try this week.
    – Aaron
    Apr 11, 2011 at 22:49
  • does your ISP have port 80 open tho? many ISPs block it
    – Journeyman Geek
    Jul 7, 2011 at 23:52

2 Answers 2

2

Not making advertisement, but in my campus SwissVPN (which runs OpenVPN) works fine because those guys configured the OpenVPN server to accept connections on port 443 (often used for HTTPS) and since the OpenVPN socket is SSL layered, to the stupid firewall in my campus it's like I'm doing HTTPS with some server.

HTTPS is not trivially distinguishable from anything else running on an SSL socket. Some poor firewalls assume SSL on 443 == HTTPS.

Try it out (setting your own VPN server on port 443 or try SwissVPN free test), it might work.

If it doesn't work and you have much spare time, you can try to find some HTTP tunneling tool but it's not clean as OpenVPN.

14
  • 2
    @Aaron Port 443 isn't open? What do they do when users need to access HTTPS sites??
    – Kromey
    Apr 11, 2011 at 21:46
  • 2
    I'm a bit confused by your answers, or you're messing up with the concept of 'open ports'. It's obvious that you can't accept inbound connections from inside your campus network without a tunnel, to any port of yours. But you can establish outbound connections, to some ports of other servers on the Internet. It's not your 443 port being open, it's just: "outbound connections to port 443 of OTHER hosts are allowed". It's different! More, if your home router doesn't accept inbound connections, then the problem has NO solution unless you use a third node.
    – gd1
    Apr 12, 2011 at 7:48
  • 1
    As a server, you need inbound access. As a client, you need to perform an outgoing connection to a certain port of a properly configured OpenVPN server. It's a classic client-server design. If this port is 443, OpenVPN can mimic HTTPS, being almost undetectable by many corporate firewalls. Some other firewalls are more clever and will break the pipe between client and server, basing on the fact that "no HTTPS connection is sometimes idle for 10 minutes!", so you'll have to reconnect every n minutes or go for a different solution (I had fair results with HTTP 'segmented' tunneling - slow)
    – gd1
    Apr 16, 2011 at 21:55
  • 1
    I know it's been a while, but I forgot to mark this answer as the best answer. I also wanted to let everyone know that I just had to change the port OpenVPN was using to 443. After doing that, everything worked fine.
    – Aaron
    Jul 8, 2011 at 2:40
  • 1
    Glad to hear. SSL on port 443 is the main flaw of every corporate firewall (as of outgoing connections)
    – gd1
    Jul 8, 2011 at 22:15
0

Personally, I prefer to run WinSSHD on my pc on campus (on port 80 rather than 22) and then open a tunnel from the outside using Tunnelier client. Then, map ports as needed to tunnel through. This isn't a VPN and so you have to manually map ports... things aren't wide open like on a VPN connection. Just an idea in case your VPN method doesn't work.

4
  • Thanks for your idea. I was actually able to get OpenVPN up and running. The main issue was that my school blocks so many outgoing ports, and one of them happened to be 1194. Changing the server on the router to listen on port 443 and connecting via port 443 did the trick.
    – Aaron
    Jul 8, 2011 at 2:38
  • You aren't connecting via port 443, you're probably using a random port... The server listens on 443 :)
    – gd1
    Jul 8, 2011 at 22:15
  • Quick question. Let's say I am connecting to an SSH server on some server that's running it on port 22. When I try connecting to an SSH server running on my VPS or even when trying to connect to Github (from the campus), it's blocked. Now, what I have done is change my VPS's SSH server to listen on a completely different port which allows me to connect from campus. If I am connecting to that different port on my VPS but am most likely using a random port on my machine on campus for the outbound connection, what would be stopping all outbound connections to port 22? Can firewalls prevent that?
    – Aaron
    Mar 22, 2012 at 15:59
  • Most networks are configured to allow outgoing ports. For example, web browsers use the 3000 range for returning connections. It is possible though that firewalls can block traffic based on protocol type rather than by port.
    – djangofan
    Mar 22, 2012 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .