Advanced network security is a standard nowadays for firewalls. Essentially, we can analyze allowed traffic for threats, malicious URLs, and more. Is there any way to trick the firewall and bypass access policies? Unfortunately, yes—if you forget to tighten your access policies.
For demonstration purposes, I have configured my lab to block access to Facebook.
And Facebook is blocked as desired
Let’s now try to trick the firewall somehow and access Facebook even when it’s blocked by the security policy.
SSH Tunneling
The SSH protocol is quite versatile. Essentially, we can tunnel other protocols through an SSH secure tunnel. How do we do that? Quite easily. We need to establish an SSH connection to a server with settings like the ones below. This means that the SSH client will listen on port 1024, and all local traffic to port 1024 will be forwarded through the SSH tunnel.
Next thing is to set up proxy on web browser, below Firefox setting as example.
Let’s try to open Facebok once again
Despite firewall restrictions, we’ve successfully accessed Facebook by bypassing the firewall’s protection. Interestingly, the traffic to Facebook doesn’t appear directly; instead, it shows up as an SSH session between our client and server
If SSH decryption is implemented, additional application SSH-tunnel become visible (Palo Alto Networks), described as: A Secure Shell (SSH) tunnel consists of an encrypted tunnel created through an SSH protocol connection. Users may set up SSH tunnels to transfer unencrypted traffic over a network through an encrypted channel. This App-ID detects applications tunneled via SSH. We cannot inspect the contents of an SSH tunnel in detail due to encryption. However, upon decryption, we can determine if SSH is being used for purposes other than management.
Using this technique, you can tunnel any application that supports SOCKS through SSH. This capability can also be exploited to establish a command and control channel.
TOR
Users can run a portable TOR browser without needing to install it or have admin rights; they simply need to click ‘Connect to Tor.’
And once more, URL filtering is bypassed. It’s that simple…
Previously, the firewall only saw SSH traffic; now, it only sees Tor traffic. There’s no visibility into what’s inside the Tor tunnel.
Recommendations:
- Block SSH Outbound Traffic: If blocking is not feasible, consider decrypting SSH traffic to detect and block SSH tunneling. Note that not all advanced firewall solutions support this capability.
- Block TOR Access: Implement a policy to block TOR access entirely. However, be aware that not all Unified Threat Management (UTM) or Next-Generation Firewall (NGFW) solutions can effectively block TOR.
As demonstrated, bypassing firewall protections can be relatively straightforward when deployments aren’t sufficiently hardened. Unfortunately, not every firewall vendor supports such hardening features, and what’s promised on datasheets doesn’t always translate into real-world security.
I will post more methods to bypass firewall, stay tuned:)