Home

Archive - Nov 1, 2006

Date
  • All
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30

Be cautious not to run SSL VPN over port 80

Submitted by jli on Wed, 2006-11-01 03:02

I have a client running a Linux box with OpenVPN for a while. It passes through my enterprise firewall to get into their own isolated environment. After the upgrade of the firewall last week, the client started to complain they lost the vpn access and my colleague started to look into it.

It took a while for my colleague to go through whole bunch of tests but could not find out why the traffic was broken after established by the firewall. I mentioned the app layer inspection factor of the firewall could be the cause and soon it was resolved.

The client is using port 80 for the SSL VPN traffic which they should not. It tends out to be the firewall is evaluating the traffic more deeply than before after the upgrade as firewall thought it's clear text http traffic. It uses a technology called protocol agent to associate the protocol with evaluation service. By took away the protocol agent, my client's SSL VPN worked again.

In this case, both sides should not be blamed actually. But as a precautions thought, do not run SSL VPN through port 80. Especially more and more firewalls are trying to do more high layer inspection nowadays.