Hello,

My company is using a palo alto firewall which replaces the SSL certificate for every HTTPS site by a company generated one. I used to bypass internet filtering by creating a SSH tunnel with Putty (I am local admin and can run Putty on my laptop) and run it on port 443. Then add a socks proxy in my browser setting and I was done. No more SSL filtering and I could access any website.

But now the firewall is blocking this as well. SSH to port 443 is not working anymore.

I tried this: https://hacktr.org/blog/2020/01/01/ssh-tunneling-over-https/ but it didn’t work either.

I also tried this: https://mariobrandt.de/archives/technik/ssh-tunnel-bypassing-transparent-proxy-using-apache-170/

But no go as well.

This has to be possible some way, by proxying apache to SSH using a letsencrypt cert. I tried to add a LE cert but the problem is when apache proxies to SSH it changes to IP ad the firewall blocks that step.

Any idea how to solve this?

​

​

  • persiusone@alien.topBEnglish
    1·
    11 months ago

    First red flag your company is a joke: you have a local admin account.

    Seriously, do not circumvent your corporate security. You have literally zero defense to these actions and can be terminated immediately. Not if, but when it happens, you will also likely be blamed for any issues which arise even if they are not directly your fault. If you did have permission somehow to do this, I am not sure why you are asking for help on how to do this. If your company does allow this, it’s even more of a joke than allowing a local admin account and that raises other questions.

    I allow my folks to BYOD on a (mostly) unrestricted BYOD/Guest network. Nobody has local admin accounts for any devices on the corp side. People can bring their personal laptops in and browse whatever and use VPNs on this network if they choose. There are some obvious restrictions (nothing illegal, for example), but if folks want to VPN to their self hosted environments or play on tiktok with their stuff, it’s better for liability, better for security/compliance, and most importantly … It is completely isolated from any corporate stuff. There is no need for circumventing when better options are available, promoting best practices for all employees.