Tunneling through 2 uncontrollable Firewalls

Ok here's the question:
Is it possible to bypass 2 uncontrollable firewalls? Here's the idea:

| | | | | | | |
| CPU 2 | --- |Firewall 2|-----Internet -------|Firewall 1| --- | CPU 1 |
| | | | | | | |

Basically the reasoning for the system is so that I can assist her remotely. She has a funny tendency to have software fail on her computer, and rather than drive across the state, I'd like to set up a system where I can just get ahold of her computer from my own.

Currently we have a few applications that I'd like to tunnel through such a system. Either computer can have applications installed on them for the purpose, they both run Windows XP, she's behind a proxy server (HTTP + HTTPS), and firewall 1 permits IPSEC.

Software I don't want to use: Microsoft Remote Assistance

I've looked at VNC, SSH, ProxyTunnel, and a few other alternatives, but I'm not sure how I can tie these together to get this system to work. If anyone has any other ideas, that would be great. Note that this connection needs to be encrypted.

If anyone knows a solution, please post!

How do you mean "uncontrolable firewalls", do you mean you can't configure the firewalls?

Yea I cannot configure or edit the settings in them.

Quote:

---

Software I don't want to use: Microsoft Remote Assistance

---

Why??? remote desktop is good...seeing you both are running XP...and its free

Or you can use a service like gotomypc

MLF

edit> guess you need to configure the firewall for the remote desktop

Why cant you configure the firewalls???

So if you are in a position where you are offering remote assistance to her, what is the reason you cant put a request in to have the firewalls configured?

Trying to find a way around the red tape that is a university. I presume I could put in a request, but I'll likely be denied.

Yup, you probably would be denied..........now think about why you would be denied.............

Nokia's Yup and thier AUP are almost spelled the same. I wonder...

cheers

Hmmm,

Looks like we have two AUPs as we have two firewalls that cannot be changed? So, if that is the case then there should be IT support at her end. They should fix her software problems?

Otherwise (assuming it is a private machine) you will have to arrange to do things "out of hours" using a private connection.

I personally think it is "mission impossible" to try to do this sort of thing if it has not been deliberately set up in advance. For a start, security at the receiving end should pick it up as some sort of attack, or unauthorised access?

:)

Try Hamachi and Real VNC. I've been using Hamachi for a few weeks now and it goes right thru firewalls, even IP Cop.

http://damagedintransit.com/2006/01/...ate-vnc-setup/

Howdy.

Would Pc Any Where be a usable option.?.

cheers
front2back

My experience with PC Anywhere is that you have to configure it thru the firewall. With both routers and Linux systems like IP Cop.

Although I haven't used Hamachi extensively yet, I've never had to configure a firewall for it to get thru. And it goes right on thru. Must be the UDP, I dunno...

Quote:

---

I've never had to configure a firewall for it to get thru. And it goes right on thru. Must be the UDP, I dunno...

---

Would you like to rephrase that... Please? Please?

Oh dear.....

Quote:

---

Originally posted here by brokencrow
... it goes right thru firewalls, even IP Cop...

---

hmmmmm. “Hamachi” must be installed on both machines - most likely adjusts your firewall settings during installation to allow the program or you must do it manually as indicated in their FAQ’s

Quote:

---

I've never had to configure a firewall for it to get thru. And it goes right on thru...

---

If “Hamachi” can slide through without any config changes, I’d recommend you check your firewall config. Someone else is probably also taking a peek.

Both machines must then, independently, connect to a “mediation server” to establish the peer-to-peer.

Hamchi

None-the-less it does sound interesting. Thanks for the info.

cheers

Hi James,

Well, since you don't have access to poke holes in your firewalls (Or do you?) I would use GoToMyPc . It uses 80 and 443 so there is only a client/server setup and you're done.
For what you want to do with it, it's a bit steep in price....business write-off?

If you do have access to the firewalls and can forward ports (Or can walk her through it) then all the above you mentioned and Remote Administrator .

My understanding is Hamachi uses UDP packets, no TCP. And, yes, it needs to be installed on both machines. As for connecting thru a firewall and/or router, there's no problem and no config'ing.

I'm sitting here at home right now, behind a Belkin router using default settings, unconfigured for any port forwarding of Hamachi, connecting to my desktop at the office via Hamachi. The desktop at the office is behind IP Cop, which is also unconfigured for any port forwarding of Hamachi's port (12975, I believe). I'm pulling up network shares via Hamachi, no problemos. And from the office, there's no problems bring up shared folder or files on this laptop.

I've installed it on several computers in our office, any number of which I'm able to connect to remotely. Again, without any need to configure any ports or port forwarding. I do a lot of mobile computing and have had no trouble connecting thru unconfigured routers and firewalls in places like coffeehouses or clients' offices. Now, having said that, I haven't tried it going thru a Cisco yet, so I can't comment on that one. But for your average router and even IP Cop, Hamachi goes right thru it like it wasn't there.

http://www.necco.ca/dv/remote_access.htm#hamachi

Let me add that Hamachi appears to use a series of mediation servers. Currently the one connecting to this laptop is at 69.90.101.31 (hosted by Peer 1 Network, a Canadian outfit) while the desktop at the office is connected to 63.34.106.7 (hosted by UUNET Technologies, Inc. in Virginia). The Hamachi site itself, though Canadian, is hosted in Europe from what I can tell.

what about a http tunnel? easy to implement, dont need admin access on XP, just start on both sides... http port for example.

But a warning: a http tunnel is easily detected by a good administrator :) (not easy to find one)

Ahhh... I see... The reason it _seems_ to be connecting through the firewall unmolested is because the software initiates a connection to the remote servers from inside the firewall when you start the app. The firewall therefore sees it as a valid connection. The app keeps the connection alive until you connect to it... again, because the initial connection was allowed by the firewall your subsequent connection to the remote appears to be just part of that valid connection so it is allowed.

I would say though, that it probably wouldn't work on my network unless it uses a common port for the protocol it uses. My egress rules are rather tight so you initial connection would probably be denied.

Yeah, TS, it can be blocked. As a matter of fact, I'm lounging around a local coffeehouse this a.m. and they got their D-Link locked down tight. No torrents, no remote admin, and no Hamachi for me this a.m. Just talked to the owner a minute ago about it and he said his brother-in-law, an admin for a local county gov't, set it up.

--sigh--

No port scanning the CitiBank servers this a.m....

;)

Quote:

---

Originally posted here by Tiger Shark
Ahhh... I see... The reason it _seems_ to be connecting through the firewall unmolested is because the software initiates a connection to the remote servers from inside the firewall when you start the app. The firewall therefore sees it as a valid connection. The app keeps the connection alive until you connect to it... again, because the initial connection was allowed by the firewall your subsequent connection to the remote appears to be just part of that valid connection so it is allowed...

---

Thanks for the clarification TS. And wouldn't that also indicate that anyone else using their server(s), regardless of their integrity, is "trusted" ?

Oh my!!

Cheers

Quote:

---

And wouldn't that also indicate that anyone else using their server(s), regardless of their integrity, is "trusted" ?

---

Why, you know, I think you're right... Golly, that's scarey... Trusting another with your own security... I never liked that... ;)

Quote:

---

Trusting another with your own security?

---

Don't we ALL do that on some level? You guys write your own OS's?

:)

Ok... I'm not reading through the last page of this. I noticed this earlier but did not have an active account.


With the people who have posted in this thread, why on earth did nobody suggest reversing the client/server model?


That is the way to bypass firewalls. We've been doing it with trojans for a long time. The "server" is actually what is traditionally thought of as the client. The only real definition for client and server is who initiates the connection basically.


Ugh.

Quote:

---

She has a funny tendency to have software fail on her computer, and rather than drive across the state, I'd like to set up a system where I can just get ahold of her computer from my

---

Errr...............does anyone really believe that (apart from Doppy :D )

And we have two firewalls that cannot have their settings altered? That means that there are ADMINISTRATORS involved (at both ends).........................so why should someone have to "drive across the state"?

Quote:

---

With the people who have posted in this thread, why on earth did nobody suggest reversing the client/server model?

---

Your answer is posted above :D

Quote:

---

Don't we ALL do that on some level? You guys write your own OS's?

---

That's a whole different kettle of fish... But just like GoToMyPC is banned, blocked and has it's own IDS rules on my network because I would have to rely upon them remaining uncompromised this software would be treated similarly...

Guess it'd be different if I lived in an "enterprise"...

Not really... The principles don't change that much with scale... The basics certainly don't.

Exactly, and the first principle is do not compromise the security of two entities and their AUPs.

Quote:

---

She has a funny tendency to have software fail on her computer

---

That does not happen to anybody...........either there is a malware problem, a software conflict problem, a hardware problem or a user ignorance problem...............or a mixture of them.

Remote desktop management tools are not what I would be looking for in the first instance.

;)

Principles may not change that much with scale, but budgets do.

Not true... You can do an awful lot with open source tools... I have... I work for a non-profit... I have more of a budget at home than I do at work.... :(

Quote:

---

Principles may not change that much with scale, but budgets do.

---

Ah, so cynical.......................but Tiger~ is fundamentally correct. Security principles are key to the issue. These do not have to be budget dependent. If I might be permitted my moment of cynicism; if your computer security principles are budget dependent, isn't it time that you reverted to pencil, paper and an abacus? :D

Now the converse of that proposition is that you can throw money at the issue till you bury yourself in the stuff, and that will not make you secure if you have not based your model on sound principles.

I see from your profile that you are a consultant. That is actually part of your problem, although "experience" might be a better word?

You see you are an external resource, which makes you a "direct cost". The problem with "direct costs" is that they are easily measurable, have to be authorised almost individually, and are subject to much more rigorous cost/benefit analysis.

On the other hand, where you have an internal IT function, security is normally a poorly defined element of the grand total of IT. Bean counters generally only split things into "revenue" and "capital"

The entity perceives that it "needs IT" and tends to accept the overall figure without that much detailed analysis.

;) :)

My reply was aimed at the thread when it first got to 2 pages....


I never bothered to read the rest.,.. I was a bit tired.

Hi

Quote:

---

why on earth did nobody suggest reversing the client/server model?

---

I was thinking along the same line, and would have suggested NetViewer[1],
an excellent tool used in professional environments. However, if I have
understood the initial post correctly, none of the two parties is able to run
the server (ie. not able to configure port-forwarding), hence even reversing
the client/server model is not the solution.

Cheers

[1] http://www.softwarespectrum.co.uk/ne...er_one2one.asp

This is a great example of why I should read the thread before posting.


Last time I saw it ws a few days ago, and I remembered it as PC--FW--FW--Internet--PC



Oh how the mighty have fallen.

Hah!

Well that explains why I did not understand you :)

I saw it as PC-- FW-- Internet -- FW -- PC.

I still stick by my comments that remote access tools only have a limited application in PC support.

The first step is to identify the real problem.

For example, hardware issues are not well suited to this approach, and if someone keeps having software problems, it is time to look beyond the obvious?

:)