Proxy tunneling - I give up!

[AirGibson]

I have to admit that the network at one company I deal with is simply too locked down to make me want to bother with tunneling a VNC connection out to my home PC through the proxy.


First, the proxy is restricted to only allowing http / https connections. No problem. Just use an http tunnel:
vnc client --> tunnel client --> company proxy --> tunnel server --> vnc server


Second, the proxy is restricted to only allowing connections on ports 80 and 443. Well, no big deal there. Just have the tunnel server forward traffic from 443 to wherever.


Third, the proxy is pretty paranoid and meshed with an IDS, thus its able to detect that your unencrypted traffic probably isn't http related. Annoying, but no big deal. Let's encrypt it with SSH and do some port forwarding:
vnc client --> SSH client --> tunnel client --> company proxy --> tunnel server --> SSH server --> vnc server



Fourth, the proxy an MS proxy that has NTLM authentication. Ugh. That in itself keeps many products from being able to use the proxy out of the box. So let's layer yet another fix using NTLM APS to allow most any application to authenticate through an MS proxy like that:
vnc client --> SSH client --> tunnel client --> NTLM APS proxy --> company proxy --> tunnel server --> SSH server --> vnc server


Fifth, the company tries to maintain a list of home ISP IP ranges and outright blocks connections to those IPs. :/ Now I'm at a loss. I'd either have to find an SSH server that someone wouldn't mind me using that also isn't blocked, or I'd have to find an unblocked IP that somehow referenced my home PC.


Sixth, the company can randomly decide to check out what you're doing on your system via monitoring software, so even if you did get it to work, chances are you'd be spotted "attempting to bypass their elite security" eventually, assuming they don't detect your elevated amount of encrypted traffic to begin with.



Thus, I give up. I wouldn't mind so much if their proxy wasn't awful. All kinds of coding communities that I would consult for advice on various projects are now blocked and the admins refuse to loosen the reigns even for specific sites that I give them. (rather, I should say that they simply don't respond to any messages) Frustrating.

 

[thirdlegstump]

On another note, we just terminated someone at our company that was trying to do the same thing.

 

[nweaver]

don't piss the it guys off...it's their job to stop you from doing that, don't whine when they do it right.

if you have a work related site that you need, take it to YOUR manger, and have them push it over the wall to IT.

 

[blemoine]

Sixth, the company can randomly decide to check out what you're doing on YOUR system

Isn't YOUR system actually THEIR system. in that case it is perfectly resonable for said company to restrict their network as they see fit.

 

[spidey07]

Sounds like that company is doing the right thing. Good for them.

I especially like the idea of blocking requests to home ISP ranges. Nice thinking.
:thumbsup:

 

[AirGibson]

While I know you might identify with network administrators, these are unfortunately not doing their job.

Apparently the notable qualifications such as "ignoring requests for access to legitimate resources" and "nothing can access the net except IE" are being gazed past. Yes, three cheers for incompetent admins. Beyond that, though, I agree. They've done a stellar job of "locking down the network". The only problem is that in doing so, they've now cost our company thousands of dollars in delays. They don't fancy paying people cash to do nothing while we wait for access that isn't coming.

It's ironic that the first reply was "someone got fired for doing something simillar" since the network admins are on the cusp of being terminated for their slow response and costly improper implementation / maintenence of a proxy. Supposedly tomorrow I'll have the access I requested literally 11 days ago

 

[cleverhandle]

Originally posted by: AirGibson
The only problem is that in doing so, they've now cost our company thousands of dollars in delays. They don't fancy paying people cash to do nothing while we wait for access that isn't coming.

I have little doubt that, if you put this in writing with an actual dollar amount specified and adequate logic behind your numbers, the management will make sure things work for you. Businesses speak $$$. If you've got records showing that you communicated to your superior the exact amount of cash the situation is costing the company, then it's their ass on the line if somebody further up finds out about it. Which means it will get done.

But if you can't come up with a solid number or all you can talk about is convenience, then don't expect anything to happen. They're business people, make a business case.

 

[nweaver]

even if it's costing money, you shouldn't try and negate the security in place, as even if they are incompetant, you could be fired.

 

[Genx87]

Not following how access to a home PC is business critical and costing the company money.