Iran Shuts Down Major Websites and Https Protocol

Re:Iran Shuts Down Major Websites and Https Protocol by peterwwillis on Friday February 10, 2012 @10:17AM (#3576096)

I haven't checked yet whether they're using layer 7 filtering or just blocking ports, but assuming it was a lame combination of the two, you can try tunneling through HTTP on port 80.

Download proxytunnel and follow this guide to set up Apache (or whatever server you prefer) to http proxy ssh connections to port 22: http://dag.wieers.com/howto/ssh-http-tunneling/

Then run ssh with proxytunnel as the ProxyCommand (as shown in the guide). It will make a plaintext HTTP connection, request a CONNECT yoursite.com:22, and if they aren't inspecting "too deep" you should be able to get an ssh connection.

If that doesn't work there's always icmp tunneling (hans), dns tunneling (iodine), and various other options. See if you can make a udp connection over port 53 to a remote host and transmit non-DNS packets; if they aren't intercepting DNS traffic, just make an openvpn udp connection over port 53 for your tunnel.

I actually have a whole paper on circumventing captive portals and firewalls and a crappy tool to probe them if anyone wants it.

[ Parent | on HN ]

Re:Iran Shuts Down Major Websites and Https Protocol by peterwwillis on Friday February 10, 2012 @12:49PM (#3576685)

Oh yeah, and if anyone in Iran wants to test it you can use my vps to test. 'ssh -o ProxyCommand="proxytunnel -p syw4e.info:80 -d syw4e.info:22" -v'. See if it does an SSH handshake. If it does, you can use this tunneling method. Also try the icmp/dns/openvpn, though. To see if DNS is not being intercepted, run 'dig +short www.google.com @syw4e.info' (or 'nslookup www.google.com syw4e.info' from windows). If it returns "127.0.0.1", you were communicating directly with my nameserver and you should be able to tunnel openvpn to a remote box on port 53.

I'll have to find the paper and clean it up a bit, but e-mail me and i'll send it when I find it and i'll post it on here. It's not amazing or anything, mostly just a talk with references to tools and articles and common flaws in captive portals.

[ Parent | on HN ]

Re:Iran Shuts Down Major Websites and Https Protocol by prinny on Friday February 10, 2012 @12:17PM (#3576564)

I would love to read that paper.

[ Parent | on HN ]

Re:Iran Shuts Down Major Websites and Https Protocol by imajes on Friday February 10, 2012 @12:33PM (#3576619)

Link? :)

[ Parent | on HN ]

Re:Iran Shuts Down Major Websites and Https Protocol by peterwwillis on Saturday February 11, 2012 @05:13PM (#3580327)

Here you go: http://opensourceandhackystuff.blogspot.com/2012/02/captive-...

[ Parent | on HN ]