Bypassing a corporate firewall in an elegant way

Once I was working on the cybersecurity project that involved installing the security sensors behind the corporate firewall. These security sensors should communicate to the central endpoint in the cloud and receive commands about software updates using Ansible scripts.

The alternative

Maybe now the solution would be in using SALTSTACK, but at that time I didn’t know that, so I decided to reinvent a new solution that may be a promising technology in the future.

The technology

It was based on the huproxy project developed in the depth of Google. Huproxy consists of the sever and the client part. The server part allows multiple client connections using the same endpoint. The ultimate goal of huproxy is to forward SSH traffic over WebSocket protocol. WebSocket communicates over HTTP (80 port) and SSH traffic is secured. Firewalls and IDS/IPS don’t know anything about traffic that goes through the WebSocket, so SSH connection can be established successfully.

Another tool that I used is a reverse SSH connection (part of SSH command) that allows the client to connect to the server so that the server can connect back to the client when needed.

And the final tool that I used was autossh command that helped to keep the constant SSH connection to the server.

Use cases

• You need to connect from outside of a corporate network back to your workstation.
• You need to manage multiple devices (including IoT based) behind a firewall using an SSH connection.

Conclusion

Some of the existing cloud-based technologies that allow doing a similar trick work too, but I’d rather skip it because you don’t own them and don’t know what in their developers’ mind. So it is better to rely to the well known Open Source solution.