SSL Tunnel to bypass Smoothwall

[Yingyz 0]

I'm trying to use an SSL tunnel to bypass Smoothwall but unfortunately it doesn't appear to work. I've tried SSH tunneling as well but that doesn't help.

 

The logs are below. 

 

 

! 2017.03.08 12:58:02 - Connecting to Mirach (Netherlands, Alblasserdam)
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:02 LOG5[ui]: stunnel 5.40 on x86-pc-mingw32-gnu platform
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:02 LOG5[ui]: Compiled/running with OpenSSL 1.0.2k  26 Jan 2017
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:02 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:02 LOG5[ui]: Reading configuration from file C:\Users\Ying\AppData\Local\AirVPN\91f5d007fe5e64fc8eca340f830f5538765982a6d8461d0550467f8416119510.tmp.ssl
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:02 LOG5[ui]: UTF-8 byte order mark not detected
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:03 LOG6[ui]: Initializing service [openvpn]
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:03 LOG5[ui]: Configuration successful
. 2017.03.08 12:58:03 - OpenVPN > OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Jan 29 2017
. 2017.03.08 12:58:03 - OpenVPN > Windows version 6.2 (Windows 8 or greater) 64bit
. 2017.03.08 12:58:03 - OpenVPN > library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
. 2017.03.08 12:58:03 - OpenVPN > MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:3100
. 2017.03.08 12:58:03 - OpenVPN > Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2017.03.08 12:58:03 - OpenVPN > Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2017.03.08 12:58:03 - OpenVPN > TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:61932
. 2017.03.08 12:58:03 - OpenVPN > Socket Buffers: R=[65536->262144] S=[65536->262144]
. 2017.03.08 12:58:03 - OpenVPN > Attempting to establish TCP connection with [AF_INET]127.0.0.1:61932 [nonblock]
. 2017.03.08 12:58:03 - OpenVPN > TCP connection established with [AF_INET]127.0.0.1:61932
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:03 LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:52608
. 2017.03.08 12:58:03 - OpenVPN > TCP_CLIENT link local: (not bound)
. 2017.03.08 12:58:03 - SSL > 2017.03.08 12:58:03 LOG6[0]: s_connect: connecting 213.152.162.70:28439
. 2017.03.08 12:58:03 - OpenVPN > TCP_CLIENT link remote: [AF_INET]127.0.0.1:61932
. 2017.03.08 12:58:04 - SSL > 2017.03.08 12:58:04 LOG3[0]: s_connect: connect 213.152.162.70:28439: Connection refused (WSAECONNREFUSED) (10061)
. 2017.03.08 12:58:04 - OpenVPN > Connection reset, restarting [-1]
. 2017.03.08 12:58:04 - SSL > 2017.03.08 12:58:04 LOG3[0]: No more addresses to connect
. 2017.03.08 12:58:04 - SSL > 2017.03.08 12:58:04 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
. 2017.03.08 12:58:04 - OpenVPN > SIGUSR1[soft,connection-reset] received, process restarting
. 2017.03.08 12:58:04 - OpenVPN > Restart pause, 5 second(s)
! 2017.03.08 12:58:04 - Disconnecting
. 2017.03.08 12:58:04 - Connection terminated.

 

 

 

[zhang888 1066]

First try on port 443.

[Yingyz 0]

 

! 2017.03.08 13:16:08 - Connecting to Muscida (Netherlands, Alblasserdam)
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[ui]: stunnel 5.40 on x86-pc-mingw32-gnu platform
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[ui]: Compiled/running with OpenSSL 1.0.2k  26 Jan 2017
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[ui]: Reading configuration from file C:\Users\Ying\AppData\Local\AirVPN\6972b761746905d3bc437f8929dd6da4a66bebbbd54f55c20ae72376cfdd550d.tmp.ssl
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[ui]: UTF-8 byte order mark not detected
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG6[ui]: Initializing service [openvpn]
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[ui]: Configuration successful
. 2017.03.08 13:16:08 - OpenVPN > OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Jan 29 2017
. 2017.03.08 13:16:08 - OpenVPN > Windows version 6.2 (Windows 8 or greater) 64bit
. 2017.03.08 13:16:08 - OpenVPN > library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
. 2017.03.08 13:16:08 - OpenVPN > MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:3100
. 2017.03.08 13:16:08 - OpenVPN > Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2017.03.08 13:16:08 - OpenVPN > Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2017.03.08 13:16:08 - OpenVPN > TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:45897
. 2017.03.08 13:16:08 - OpenVPN > Socket Buffers: R=[65536->262144] S=[65536->262144]
. 2017.03.08 13:16:08 - OpenVPN > Attempting to establish TCP connection with [AF_INET]127.0.0.1:45897 [nonblock]
. 2017.03.08 13:16:08 - OpenVPN > TCP connection established with [AF_INET]127.0.0.1:45897
. 2017.03.08 13:16:08 - OpenVPN > TCP_CLIENT link local: (not bound)
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:52869
. 2017.03.08 13:16:08 - OpenVPN > TCP_CLIENT link remote: [AF_INET]127.0.0.1:45897
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG6[0]: s_connect: connecting 213.152.162.155:443
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[0]: s_connect: connected 213.152.162.155:443
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[0]: Service [openvpn] connected remote server from 172.16.2.52:52870
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG6[0]: SNI: sending servername: 213.152.162.155
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG6[0]: Peer certificate required
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG4[0]: CERT: Pre-verification error: self signed certificate in certificate chain
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG4[0]: Rejected by CERT at depth=2: CN=Smoothwall-default-root-certificate-authority
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG3[0]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
. 2017.03.08 13:16:08 - SSL > 2017.03.08 13:16:08 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
. 2017.03.08 13:16:08 - OpenVPN > Connection reset, restarting [-1]
. 2017.03.08 13:16:08 - OpenVPN > SIGUSR1[soft,connection-reset] received, process restarting
. 2017.03.08 13:16:08 - OpenVPN > Restart pause, 5 second(s)
! 2017.03.08 13:16:08 - Disconnecting
 

 

Thats what I got when I tried using 443

[zhang888 1066]

That's a much better sign. Just change the line

verify = 3

to

verify = 0

 

in your .ssl file and try again.

[Yingyz 0]

Could you tell me how I could change that line?

 

I'm using the Eddie GUI and I don't know if that gives an option to change config files.

[Yingyz 0]

Bump, anyone got any suggestions?

[TheDarkOnyx 0]

I have had success bypassing a restrictive firewall connecting to Dheneb using SSL on port 28439. Unfortunately, it's the only  one working. Everything else gives me a "connection reset by peer".