Escaping the corporate or educational firewall, or 'how to play FarmVille from work'
Fortunately, in most non-enterprise cases (if you work at IBM, this guide probably won't work), networks are set up by technicians that don't know their RJ45 from their RJ14, their patch cable from their patch server, their silicon from their silicone -- in short, most corporate and educational networks are easy to break out of.
With this guide, you can be surfing Facebook, jacking off to Cam4 or playing World of Warcraft within 10 minutes. Some of the methods described are easy to pull off, and some will require technical expertise. Still, if you're reading this from work you've got plenty of time to blow, eh?
Note: as some commenters have said, evading firewalls might get you fired -- or expelled from school -- so be careful!
1. First, always try a proxy server, anonymizer or VPN
It's the oldest trick in the book, but more often than not it works. Basically, by re-routing your Internet requests via another computer, you might be able to avoid the corporate firewall.
There are two ways to go about proxying, depending on how draconian your administrator is:
- Try one of the many Internet proxies/anonymizers -- in many cases, you can simply visit one of these sites, type in an address, and off you go. HideMyAss works well, Vtunnel is fantastic -- or simply hit up Free Proxies' huge listing and keep trying until you find one that works.
- If your browser hasn't been locked down, it can be as simple as setting the Proxy Server in your settings -- Web browsers can all be setup to force communication via a proxy. Find an IP address from this list (or Google for 'free proxy list') and then configure your browser to use it. If you don't know how to set a proxy server, here's a comprehensive guide. (Chrome is Options > Under the Bonnet > Change proxy settings.)
If you can't change your proxy settings, see step 3 below. - If you can install software, try a virtual private network (VPN) solution -- in most cases you can't install software on corporate or educational networks, but if you can, try the Free VPN.

More often than not, administrators simply ban websites by name or keyword (every domain name with 'cam' in, for example). A proxy might work today, but it could be blocked tomorrow. If you only need access to the text of a site, Babelfish or Google Translate should be able to help you. Just type an address in and voilá! Make sure you translate from an obscure language into English, or it might refuse to work.
If your administrator has blocked the translation sites, you could always use a brute-force IP address approach. Visit this page, type in a host name ('www.google.com'), and then paste the resolved IP address into your Web browser. It might work, it might not -- and it probably won't work beyond the first page.
Did you know that both Firefox, Chrome and Opera can run without being installed? You can put them on a USB stick [Firefox download, Chrome download, Opera download], slap it into the locked-down machine and simply run your browser from the stick. On the off-chance that USB sticks are disabled (some network administrators are mean bastards), you could download a standalone version of Firefox, Chrome or Opera straight to the computer.
In some cases the actual blocking is done by the installed browser, so using a portable version will completely circumvent the network's security. With a portable browser you are also completely free to set a proxy server, as described in step 1.

This one was new to me, but hey, I'm all for weird and wonderful workarounds! Open Notepad (Start > Programs > Accessories > Notepad) and then File > Open. Paste your URL into the box usually reserved for filenames and press enter.
It usually takes a while -- and it won't work for every site -- but you just might end up with a Notepad full of HTML code! You can then save the file as 'whatever.html' (the .html is important) and open it in a regular Web browser, Microsoft Word, or any number of programs that understand HTML files.

Sometimes a business or school computer is simply locked down too damn well. It's rare, but there are some network admins that are capable of running a tight ship. Hopefully you haven't got this far in the guide, but if you have, here are a couple of last-gasp efforts that might just work.
- Remote Desktop -- this is for Windows users only. Enable Remote Access on your home computer by right clicking My Computer > Properties > Remote (or 'Remote settings'). The process varies a little from XP to 7 to Vista -- if you can't find it, use this FAQ.
You will need to write down your home IP address (and you will probably have to set up port forwarding too).
Then, from your work or school computer, run Start > Programs > Accessories > Remote Desktop Connection. Type in your home IP address, and pray that the network administrator hasn't blocked the port. (You can always change the port though. Try port 80!) - VNC -- this is like Remote Desktop, but cross-platform. It has both a server and a client component, just like Remote Desktop. There are many guides -- and many variations -- but this guide is enough to get you started.
- SSH tunnelling -- of course I saved the best for last! This by far the hardest to set up -- and you'll need a colocated or dedicated server to pull it off -- but really, if SSH tunnelling doesn't work, you should congratulate your network administrator being more oppressive than a Korean god-emperor.
This guide covers a Linux/Windows XP setup. Mac users can use this guide. Again, SSH tunnelling is not for the faint of heart!
If you have another method for circumventing a corporate or educational firewall, leave a comment!














Comments
43
Subscribe to commentsAlex ThurgateJul 1st 2010 2:25PM
Seb : Are you sure the proxy blocker works for watching hula TV streams from the UK, as i have been trying for ages to find a solution to watch shows on hula or am i doing something wrong when i run VTunnel
Sebastian AnthonyJul 1st 2010 2:48PM
Last I checked, the FreeVPN works for Hulu at least -- if you can find an American VPN server (you might have to pay).
But I'm sure Hulu is constantly updating their blocking technology...!
LaurenJul 1st 2010 2:37PM
I wonder how many network admins read this site ... Bet a lot of people will be beefing up security thanks to this article. ;-)
ZeRoJul 1st 2010 2:48PM
Blocked and Blocked
1,2. Websense or BlueCoat Reverse Proxy
3. Faronic Anti-Executable
4. Can't reproduce it.... Possibly due to 1,2 or 5
5. Firewall rules filtering non-standard traffic including remote RDP.
Sebastian AnthonyJul 1st 2010 2:49PM
Possibly -- but it gets to the stage where you impact legitimate work!
There will always be a loophole, basically :) And in most cases it's simply not worth the effort of 'going the extra mile' to close a particularly tricky loophole.
Sebastian AnthonyJul 1st 2010 2:53PM
How does the anti-executable thing work...?
ericloeweJul 1st 2010 5:01PM
I guess it has a whitelist of allowed executables. Anything else is blocked, I guess.
Sebastian AnthonyJul 2nd 2010 2:59PM
Well, the thing is, it has to somehow 'detect' what EXEs are running. The portable Firefox executable is identical to the 'installed' one... it just runs in its own directory!
Alex ThurgateJul 1st 2010 2:46PM
Seriously doubt it, amount of hassle for the network admins is not worth it for the amount of people that would use these techniques as most people either dont care or are too lazy to do anything about the filtering.
HexxehJul 1st 2010 5:59PM
If none of the other methods have worked, there's pretty much not a chance they'll have left access to SSH open.
One interesting trick if they use NTLM-authenticated ISA servers to proxy you though, is NTLMAPS (http://sourceforge.net/projects/ntlmaps/) combined with an SSH server running on port 443. I can use this to punch holes through the firewall at college via SSH. Once you've got your SSH tunnel open, you can do pretty much anything you like.
Sebastian AnthonyJul 2nd 2010 3:10PM
Ah, good ol' port 443! I've used that one sooo many times...
That NTLMAPS thing looks very cool! If I actually had an office, or school, I would definitely use it :)
BrianJul 1st 2010 3:30PM
You totally forgot about using VMware Player on your company computer and using a VM on a flash drive.
mer2329Jul 1st 2010 3:34PM
my college will ban your mac address you if you use torrents
so I manage my torrent downloads through my home computer using log me in
but you mentioned the remote assistance thing in the article
Sebastian AnthonyJul 2nd 2010 3:17PM
That always works!
Sometimes you want to make use of your college or school's juicy bandwidth pipe though...!
mer2329Jul 3rd 2010 1:55AM
true
but they detect the ports and protocols
if your using one of those they ban your computers mac address
paralleljohnnyJul 1st 2010 4:06PM
My company has the number 1 blocking tool on top of similar tools that ZeRo mentions: A Standard Practice document that states compromising the system in anyway is terms for discharge.
ericloeweJul 1st 2010 5:05PM
You're never compromising the system. Unless of course you use some shady proxy or something like that. But if you do something clean, then there's no problem at all. Except of course the lost productivity, but who still cares about that?
Alex ThurgateJul 1st 2010 5:21PM
Ouch. I can see why you dont want to even go near any of these techniques, as having a job in a recession is more important then going on facebook at work !!
Sebastian AnthonyJul 2nd 2010 3:19PM
Well, I would certainly ask to see the contract!
As I said in another comment, you're being PAID... so it pays to behave...!
Seriously though, I would expect a warning from most companies before being fired for playing FarmVille during your lunch break...
Matt JonesJul 1st 2010 5:33PM
A simple PHP script on a hosted web server works as well. Check out the PageEmailer link at http://mattwjones.net/?page_id=136.
** Disclaimer: This tool was not originally designed to circumvent filtering systems. It only works reliably with site text. Also, use at your own risk, I am not responsible when you get yourself fired. **