Connecting Remotely through proxy

[beany1]

Contacted our internet / filtering / proxy provider today asking how I could remote desktop to our servers remotely which would need to go through their proxy server. I am also wanting to maybe setup something like the Home Access+. Our provider has informed me to do this we would need to setup a VPN requiring a token at a one off cost of £600 then £100 per year there after.

 

Is this a standard price? Is there alternates to this setup? Would this VPN be required to setup IIS to provide access such as Home Access + and would it work through such a setup?

 

I'm unsure of the workings of a proxy server and I've only done very basic VPN setup so any advice greatly appreciated!

[sven]

Really all depends on your provider. We use the local council to provide our connection to the outside world, and they are wanting £500 for alter some firewall rules in order to allow our Exchange Server to communicate with the outside world via SMTP. It's a joke, but "whatcha gonna do?"

 

As for the £100 a year afterwards? Sounds like a rip off to me. Not like there's any ongoing maintenance needed is there. Offer them a pound.

[beany1]

Gonna have to read more into it so I can really have an argument with them and then offer a pound! I did think the price seemed a bit ridiculous!

[Ignatius]

Gonna have to read more into it so I can really have an argument with them and then offer a pound! I did think the price seemed a bit ridiculous!

 

I can understand a fee to set it up in the first place. Why not ask them the reason for the regular fee? What does it cover? For instance, if the VPN fails and it's due to something at their end (i.e. a coincidental misconfigration, maybe when they're setting up someone else's VPN), they should restore yours immediately without any charge to you because it was their fault.

[beany1]

Is there no other way around it? Do I have to use a VPN? A understand a fee but with what we pay I think £600 is a lot in fact too much to consider. From what I did with VPN isn't a case of ipsec on both ends? as well as the obvious port and firewall settings.

[dhicks]

Do I have to use a VPN?

 

No - I'm setting up remote access (via RDP to a Remote Desktop Services machine) using SSH port forwading. You just need your firewall to allow incoming access via port 22, then forward that port 22 traffic to a machine running an SSH server. You can set your SSH server up so it only allows access via certificate, not password, and dish out a certificate for each user - if someone looses their laptop you simply generate them a new certificate, invalidating the old one. PuTTY has a included command line tool that will allow you to set up a forwaded connection, and I've wrapped a handy executable around it that sets up a forwaded connection and opens Remote Desktop Client ready for the user to log in to the remote computer. I'm just finishing off a web-based front-end tool for administering the SSH certificates, with a tool that bundles everything you need for an autorun CD/USB stick for each client into a ZIP file ready for download.

[somabc]

Could you not use remote desktop gateway to bypass VPN and route everything over HTTPS?

[beany1]

@dhicks sounds great you providing that as a download? I tried tunnelling with openssh and putty so far little progress.

 

@somabc also sounds great but I haven't got a clue how I would do that!

[KK20]

You will need to SSH over a port that is already open (i.e. already going to the server) then you can tunnel port 3389 on the client. It may not work if the firewall filters on protocol (thus blocking SSH).

 

remote desktop gateway looks great but its 2k8R2 only ( Deploying Remote Desktop Gateway Step-by-Step Guide )

 

Can you get openSSH working at all?

[beany1]

so at the moment I've managed to get ssh to work to putty on the client (only locally - Ill deal with convincing our internet provider to unblock ssh once I know I can do it!) and can open remote desktop and use 127.0.0.2 to open the server but on login if I log in with my domain login I am told Access is denied? any ideas?

[dhicks]

on login if I log in with my domain login I am told Access is denied? any ideas?

 

Are you a member of the server that you are trying to log into's Remote Desktop Users group?

[beany1]

Erm I'm assuming so, if I remote desktop without the ssh tunnel I can log straight into the server? Or is there something I need to check?

[sukh]

Really all depends on your provider. We use the local council to provide our connection to the outside world, and they are wanting £500 for alter some firewall rules in order to allow our Exchange Server to communicate with the outside world via SMTP. It's a joke, but "whatcha gonna do?"

 

As for the £100 a year afterwards? Sounds like a rip off to me. Not like there's any ongoing maintenance needed is there. Offer them a pound.

 

What was you trying to do with exch, you can always use RPC over HTTP which uses 443 which would probably be open anyway.

[dhicks]

if I remote desktop without the ssh tunnel I can log straight into the server?

 

Hmm. You're right, you should be able to log in, then. Unless your server is set to only accept logins from a particular IP address (or range of addresses)?

[KK20]

have you setup openssh to accept users for domain logins?

 

Look at this guide here OpenSSH for Windows

 

TBH I would look at ONE issue at a time. Get SSH working first *then* worry about RDP

[GrumbleDook]

What was you trying to do with exch, you can always use RPC over HTTP which uses 443 which would probably be open anyway.

 

If you are not using 2k8R2 and Windows 7 then this is not secure (initiation of connection is, but traffic afterwards isn't). I've had a school trying it with XP Clients and the required patch and it is flaky ... I am eager to see a school get this running though.

[sukh]

If you are not using 2k8R2 and Windows 7 then this is not secure (initiation of connection is, but traffic afterwards isn't). I've had a school trying it with XP Clients and the required patch and it is flaky ... I am eager to see a school get this running though.

 

Forgot to add s on https:

 

Secure then isnt it?

 

Or did you mean something else?

[beany1]

So the guides I had read suggested the port 3390 but apparently this is blocked on Windows 7 so using port 3391 it works!

 

Just to convince our provider that I should be allowed ssh rather than using their vpn at £600.

 

Thanks for all the help!

[dhicks]

have you setup openssh to accept users for domain logins?

 

I'm using a Debian VM, integrated with Active Directory via Samba - domain users can log in to the machine with their domain credentials. When I get the web-based admin utility finished I'll make it publically available as it might come in handy for someone else.

[KK20]

sorry, I should have been clearer, it was directed more at beany (as you have a working solution). When I setup openSSH on server 2008 installing it wasnt enough, you need to configure it to your own domain etc. Hence me asking.

[beany1]

So I've received a response to my request for port 22 opening:

 

 

With regards to your change request, I have read through your emails of late to the service desk and would like to advise.

 

I feel that Port 22 inbound will not be allowed by our security team (the change would have to be sent to them for review due to the nature of connections over port 22) We have had issues before due to the number of known exploits using SSH.

 

You have to remember that when making an inbound connection to your network you are opening up the server to the internet via a NAT’d IP address. This puts it at risk to all sorts of attacks and requires you to maintain and implement high security. As a result of this, a disclaimer sent to the head teacher accepting all responsibility for the network and its security before we can allow it.

 

There are other solutions available for remote access to your network. I appreciate the price quoted for our VPN is high, but if you ask whoever has the Service Portfolio for 2011 which was provided to all schools you will get the accurate pricing for the VPN solution. (I believe it is £100 per token (user) per year) This is a secure and usable solution for RDP over the internet which can provide you full local network access whilst keeping the school network secure.

 

Other solutions have been implemented by other schools, such as TSGateway on Windows Server 2008. This also requires a NAT’d IP and puts the security on the school, however it is a known “out of the box” secure solution and is accepted as such.

 

 

Any thoughts / Opinions on this??? I know for a fact my school wouldn't consider the VPN of £600 setup then £100 per year.

[dhicks]

I feel that Port 22 inbound will not be allowed by our security team (the change would have to be sent to them for review due to the nature of connections over port 22) We have had issues before due to the number of known exploits using SSH.

 

Can they tell you what the exploits are? Does SSH get hacked more often than their VPN solution - is their VPN solution actually more secure, or has it just not had anyone try to break it? Can you ask them for RDP-over-HTTPS access and then just use port 443 for SSH anyway?

 

You have to remember that when making an inbound connection to your network you are opening up the server to the internet via a NAT’d IP address.

 

If you make your SSH server only accept connections with a certificate, then only people with a valid certificate should be able to log in, unless there's some way of getting around that. I'd also look at making sure the SSH server will only port-forward to your RDP server.

 

I know for a fact my school wouldn't consider the VPN of £600 setup then £100 per year.

 

Hang on, is that £100 per user per year?

[KK20]

openssh doesnt HAVE to listen on port 22. Indeed mine doesnt. Just change it to a port that IS open and forwarded on your network. Incidentally do you use FTP? FTP is far far more vulnerable than SSH, ask them can you have SFTP (which is SSH in a different coat) instead....

[beany1]

Thanks for the reply dhicks - glad I'm not the only one thinking the situation is ridiculous. I'm gonna forward on your questions and see what they say.

 

Also for the firewall changes they requested a destination IP and source IP, so I supplied my home WAN ip. Surely that means that the only way to exploit ssh is from my home IP?

 

This setup was literally for me to access the server from home and do any tasks that I don't have time or can't do at work - But yes the £100 is per user!

[beany1]

@KK20 thanks, Don't know how to get around the port issue the only ones open are standard ones like 80 and imap etc. To open a port they want to know all the details.