Show Posts
1
HFS ~ HTTP File Server / Re: Trouble connecting HFS thru Stunnel
« on: June 09, 2007, 05:15:10 AM »
Thx ~GeeS~!!!
Well, routers have firewall but you cant control the actual "application" that is using that port, therefore combining with a software firewall you have absolutely full control of the application that you are running. Its just a matter of how secure you want it to be.
If u did not open port 80 in the router, the bypass trick wont work. As you can see in the Router firewall rule I wrote, only Stunnels 443 is open. Beside, the Port 80 its just an example. Of course, any port superior of 1024 is better. For example 44300
The forwarding localhost:443 to localhost:80, well its not a "forwarding" rule, its actually a software firewall rule and its applied only to stunnel.exe meaning that for the stunnel.exe (the application) the only ports that it can access are (443 and 80). The port 80 in this case is used by HFS.
Actually you can use mostly any port to do anything, for example: before this I was using port 80 for uTorrent and worked just fine, it just a matter of how you configure it.
To be sure about the bypass Ive just recheck the configuration. The following test is to see if using the rule I set for router and firewall can be bypassed form outside (internet) if the HFS is set to port 80. Entering in the address bar your public address follow by :80/
settings of HFS to leave it wide open:
Port 80
delete \127.0.0.1 in the Ban list.
Menu --> Accept connections on --> Any address.
This way HFS can connect to any address and its listening at port 80.
How did I check:
First: if you connect using your public ip (the one assigned by your ISP) and adding ":80/" at the end it will probably link to your router administration page. See this post: http://www.rejetto.com/forum/index.php?topic=3083.msg1015853#msg1015853 from blueeagle69. All he could see is his router, he is trying to connect to his HFS thru local network using a public IP.
Second: if you connect to the PC that is hosting HFS using the private ip within the local network of course, you will get access. But that is local network (inside your home or office network) and is not form outside (internet).
So there are 2 ways to test it:
1) Connect from somewhere else.
2) you can use a anonymously surf page or a proxy like this one: http://www.htmlblock.co.uk/anon.php
To start, connect to your HFS like usual for example: https://myhomeserver.com/ You can see in the Stunnel's log that the incoming connection ip address is different than your public ip. like this one: 213.171.218.198 that is the ip of www.htmlblock.co.uk
Once you make sure that you are accessing your HFS form outside. Connect using http://yourpublicip:80/ and see what happens. If everything is secure you should get a "Error: Could Not Connect to Server" message. If you can connect to your HFS either you are connecting from your local network or your router has the HFS port open.
After all the propose of using STUNNEL is to secure our HFS some people like 80 some like 44300 and some like 666
(Im using this one now) is entirely up to the user. But like I said, if you are behind a router and have a software firewall and you want STUNNEL then those are the rules to open ports. And of course configuration of software firewall and routers may differ one from each other but the logic are always the same.
One last thing (its getting too long now) using dyndns webhop to redirect your address so you dont have to write the "https" anymore is really good trick.
regards!
Well, routers have firewall but you cant control the actual "application" that is using that port, therefore combining with a software firewall you have absolutely full control of the application that you are running. Its just a matter of how secure you want it to be.
If u did not open port 80 in the router, the bypass trick wont work. As you can see in the Router firewall rule I wrote, only Stunnels 443 is open. Beside, the Port 80 its just an example. Of course, any port superior of 1024 is better. For example 44300
The forwarding localhost:443 to localhost:80, well its not a "forwarding" rule, its actually a software firewall rule and its applied only to stunnel.exe meaning that for the stunnel.exe (the application) the only ports that it can access are (443 and 80). The port 80 in this case is used by HFS.
Actually you can use mostly any port to do anything, for example: before this I was using port 80 for uTorrent and worked just fine, it just a matter of how you configure it.
To be sure about the bypass Ive just recheck the configuration. The following test is to see if using the rule I set for router and firewall can be bypassed form outside (internet) if the HFS is set to port 80. Entering in the address bar your public address follow by :80/
settings of HFS to leave it wide open:
Port 80
delete \127.0.0.1 in the Ban list.
Menu --> Accept connections on --> Any address.
This way HFS can connect to any address and its listening at port 80.
How did I check:
First: if you connect using your public ip (the one assigned by your ISP) and adding ":80/" at the end it will probably link to your router administration page. See this post: http://www.rejetto.com/forum/index.php?topic=3083.msg1015853#msg1015853 from blueeagle69. All he could see is his router, he is trying to connect to his HFS thru local network using a public IP.
Second: if you connect to the PC that is hosting HFS using the private ip within the local network of course, you will get access. But that is local network (inside your home or office network) and is not form outside (internet).
So there are 2 ways to test it:
1) Connect from somewhere else.
2) you can use a anonymously surf page or a proxy like this one: http://www.htmlblock.co.uk/anon.php
To start, connect to your HFS like usual for example: https://myhomeserver.com/ You can see in the Stunnel's log that the incoming connection ip address is different than your public ip. like this one: 213.171.218.198 that is the ip of www.htmlblock.co.uk
Once you make sure that you are accessing your HFS form outside. Connect using http://yourpublicip:80/ and see what happens. If everything is secure you should get a "Error: Could Not Connect to Server" message. If you can connect to your HFS either you are connecting from your local network or your router has the HFS port open.
After all the propose of using STUNNEL is to secure our HFS some people like 80 some like 44300 and some like 666
(Im using this one now) is entirely up to the user. But like I said, if you are behind a router and have a software firewall and you want STUNNEL then those are the rules to open ports. And of course configuration of software firewall and routers may differ one from each other but the logic are always the same.One last thing (its getting too long now) using dyndns webhop to redirect your address so you dont have to write the "https" anymore is really good trick.
regards!
)