Tunneling through an HTTP proxy

A little chatter to start won’t hurt. After finishing my civilian service at the Faculty of Education, which had fiber practically all the way to my 10/100 Mbit network card, I returned to an unnamed company. Being an internet addict, I swallowed the fact that internet access at work was restricted to HTTP and to certain servers and ports. We had two HTTP proxies. The first required authentication and monitored data and time. The other was open to everyone, but only for selected servers or domains. The list could be changed, but was capped at about 100 domains. Miserable conditions for someone used to IRC, ICQ and SSH. So I set about tunneling a connection out. Like any good tunneler, I got a domain added to the open proxy, one where a friend had a computer with unrestricted internet access. The idea was to tunnel over HTTP requests to that internet-connected computer and back. Data from my machine on the intranet goes over HTTP to the “open” proxy, then on unchanged to the internet host, which processes it and does something with it. That brings us to implementation.

A great help was a Java program called “Socks via http.” It creates a SOCKS proxy on the client, the computer on the intranet, and tunnels data over HTTP to the server component on the internet host and back. I tried other programs, of course, but only that one worked. Our HTTP proxy defaulted to port 80 and wouldn’t accept any other, and entering port 80 explicitly in the URL returned 403. Most programs fell over on that error. My friend started the server component on a higher port. He wasn’t thrilled to download a JRE for a program of about 30 KB. He tunneled my requests from port 80 with iptables, so his web server carried on serving everyone else as if nothing had happened. I started tunneling. The program said “checking version — OK,” and I was in the clear :). I tried IRC first. Everything was wonderfully fast. I got ICQ and the web working, with no more restrictions to bother me, and even SSH. That might have been my happiest day at work…

That’s the end of the story. If it bored you, feel free to stop here. Only bad news follows :].

Now the bad news. After about a week of browsing, the proxy admin noticed an unusually large number of requests to one “server” and acted. My IP is on the blacklist today, and I can forget about tunneling for a while. I’m no lightweight, so changing my IP is easy, but it won’t solve the problem. Hacking the proxy would solve it :), but AIX isn’t my favorite. So I browse through a proxy on another computer, which isn’t blacklisted :). It’s another Java program that just forwards a port to another IP and port, and I’m in the clear. It also occurred to me to sniff the passwords of users who log in to the authenticated proxy. Believe me, it works, but sooner or later word would get out…

The sad part is that we’re a company with a great many employees, and yet there are restrictions on something as free as the internet. I talked to an admin from i.cz today. He said everyone there has unrestricted internet. Well, it works in some places, and in others…