Port 443?
-
@JKnott I have used 80 and 443, both UDP successfully. The problem I hit is when they block undefined domains and IPs. My personal domain will remain undefined unless someone has a trick to get it defined.
They are trying to do good, but they are also preventing people from protecting themselves on an untrusted network.
-
Fortunately, I have a public DNS entry for my home network, so that shouldn't be an issue.
-
@JKnott I may have not been clear. I own a domain, but it is unclassified by companies like zScaler, so if the firewall operator denies unclassified domains then my domain is denied.
-
@AndyRH Yeah only way around that is to contact the company doing the filtering - most of them have sites to lookup a site/ip for its category and request a category. Many of them - at least when I was running web filtering for a large company would allow a suggestion, but they didn't always follow that direction. This was quite a few years back now - more than likely some AI will look at the site and categorize it. Be it where this portal/site is open to the public is another question.. Again many many years ago since I was doing this sort of thing.. Well over a decade for sure - jfc time flies ;) Might even be freaking 20.. man I am getting old ;)
Guess your problem would be are you actual also hosting a site on the ip/fqdn that would fall into a category that would be allowed. I run openvpn on 443 as well, have not done it via quic only tcp - but with port sharing.. Openvpn looks at the traffic and says hey this is not vpn traffic and passes it to my haproxy so the site can be served.
in your openvpn custom options box
port-share 127.0.0.1 9443;
Where ha-proxy is listening on 9443.
edit: Well F me - just thought about it, and that was like 2008/9 - did that for a few years before moved to the dc lan team, I had done web filtering admin for many years before that.. But yeah 2009 or so when was doing that full time. That was websense back well before becoming forcepoint.. Just looked up how to report for them
https://support.forcepoint.com/s/article/How-To-Submit-Uncategorized-Sites
So you would have to know who they are using for filtering - quite often it would be reported in the block page. And sometimes how to submit for allowing or recat, etc..
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 26.03.1 | Lab VMs 2.8.1, 26.07 -
@johnpoz I have tried a few times with zScaler, it remains uncategorized because it is really just my home web site. I can't say they are not doing their job correctly.
Escaping restrictive untrusted WiFi is at least an interesting problem. -
@AndyRH if you hit the site on normal 80/443 does some site get presented that they could put in a category? Might want to look into the openvpn port sharing thing.. You could put up some site about bird watching or something ;)
-
@johnpoz Not currently. I had not thought about a boring site that could be categorized. Good idea. It runs on a Pi so I have to be careful to not attract a crowd.
-
I run openvpn on 443 as well, have not done it via quic only tcp - but with port sharing.
You should be using UDP as TCP tries to impose flow control over something that already has flow control. QUIC uses 443 UDP and HTTPS uses 443 TCP. Those, along with OpenVPN would have the appropriate header and OpenVPN is usually incoming while those other two are outgoing, so 443 UDP would go to whatever system you're running OpenVPN on. I use my firewall.
-
@JKnott I might play with it - but I just put it up for a scenario when 1194 is blocked.. I know it works because have tested that I can connect to that instance and do stuff.
But to be honest, I don't recall a time where I actually had to use it ;) Only time I actually use the vpn is when on a road for work or vacation. I could always just use my cells phone connection if need be, and also could just wireguard in as well.
I also normally turn on chrome remote desktop when go on vacation for a couple of weeks to visit the grandkids - but I thought I read somewhere they are closing that up?
When stay at hotel - with rewards level I am at, normally always have the higher end wifi for free that doesn't block vpn, etc. I could prob just shut down that instance to be honest.
-
I only use a VPN occasionally these days, but I used to do a lot of travelling for my work. I ran my own mail server then and used a VPN to access it. This was before smart phones became popular and my cell phone could only do SMS. This was so far back I was using CIPE for the VPN. It was also when I discovered that using the popular subnets at home was a bad idea because I'd run into conflicts between my home network and the one at the hotel I was staying at.
I didn't have a problem with the WiFi at the hotels I was staying at, other than one place that had some problem that had nothing to do with a VPN. I've only come across blocked VPN at the local library and community centres. A popular donut/coffee shop has no problem with VPNs. I also have the employee WiFi password, as I did some work at some locations for that chain several years ago. This allows me to bypass all the ads, etc. that you'd normally get on their network. I haven't tried a VPN with the customer WiFi access though.
Privacy Policy · Cookie Policy