ICMP Tunnel

Angenommen wir haben einen "RootServer" im Internet

mit der WAN IP: 1.2.3.4

Dort lassen wir das Programm: ptunnel und Squid laufen.

# apt-get install ptunnel

startscript

/etc/init.d/ptunnel

#! /bin/sh

### BEGIN INIT INFO

# Provides:          ptunnel

# Required-Start:    $remote_fs $network $syslog

# Required-Stop:     $remote_fs $network $syslog

# Default-Start:     2 3 4 5

# Default-Stop:      0 1 6

# Short-Description: initscript for ptunnel

# Description:       initscript for ptunnel

### END INIT INFO

# Do NOT "set -e"

# PATH should only include /usr/* if it runs after the mountnfs.sh script

PATH=/sbin:/usr/sbin:/bin:/usr/bin

DESC="IP over ICMP tunneling server"

NAME=ptunnel

DAEMON=/usr/sbin/$NAME

DEFAULT=ptunnel

DAEMON_ARGS=""

PIDFILE=/var/run/$NAME.pid

SCRIPTNAME=/etc/init.d/$NAME

# Exit if the package is not installed

[ -x "$DAEMON" ] || exit 0

# Load the VERBOSE setting and other rcS variables

. /lib/init/vars.sh

# Define LSB log_* functions.

# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.

. /lib/lsb/init-functions

# Get config

get_config() {

        [ -r /etc/default/$DEFAULT ] && . /etc/default/$DEFAULT

        if [ "$run_daemon" != "true" ] ; then

                [ "$VERBOSE" != no ] && log_progress_msg "- automatic start disabled" && log_end_msg 0

                exit 0

        fi

}

#

# Function that starts the daemon/service

#

do_start()

{

        # populate $DAEMON_ARGS

        get_config

        #

        # Return

        #   0 if daemon has been started

        #   1 if daemon was already running

        #   2 if daemon could not be started

        start-stop-daemon --start --quiet --exec $DAEMON --test > /dev/null \

                || return 1

        start-stop-daemon --start --quiet --background --exec $DAEMON -- -x "" -m 200\

                || return 2

        # Add code here, if necessary, that waits for the process to be ready

        # to handle requests from services started subsequently which depend

        # on this one.  As a last resort, sleep for some time.

}

#

# Function that stops the daemon/service

#

do_stop()

{

        # Return

        #   0 if daemon has been stopped

        #   1 if daemon was already stopped

        #   2 if daemon could not be stopped

        #   other if a failure occurred

        start-stop-daemon --stop --quiet --retry=TERM/5/KILL/5 --exec $DAEMON

        RETVAL="$?"

        [ "$RETVAL" = 2 ] && return 2

        # Wait for children to finish too if this is a daemon that forks

        # and if the daemon is only ever run from this initscript.

        # If the above conditions are not satisfied then add some other code

        # that waits for the process to drop all resources that could be

       # needed by services started subsequently.  A last resort is to

        # sleep for some time.

        start-stop-daemon --stop --quiet --oknodo --retry=0/5/KILL/5 --exec $DAEMON

        [ "$?" = 2 ] && return 2

        # Many daemons don't delete their pidfiles when they exit.

        rm -f $PIDFILE

        return "$RETVAL"

}

case "$1" in

  start)

        [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"

        do_start

        case "$?" in

                0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;

                2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;

        esac

        ;;

  stop)

        [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"

        do_stop

        case "$?" in

                0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;

                2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;

        esac

        ;;

  restart|force-reload)

        log_daemon_msg "Restarting $DESC" "$NAME"

        do_stop

        case "$?" in

          0|1)

                do_start

                case "$?" in

                        0) log_end_msg 0 ;;

                        1) log_end_msg 1 ;; # Old process is still running

                        *) log_end_msg 1 ;; # Failed to start

                esac

                ;;

          *)

                # Failed to stop

                log_end_msg 1

                ;;

        esac

        ;;

  *)

        echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2

        exit 3

        ;;

esac

# update-rc.d ptunnel defaults

# /etc/init.d/ptunnel start

Auf dem Client ptunnel installieren oder kompilieren

# ./ptunnel -m 30 -p 1.2.3.4 -lp 8000 -da localhost -dp 3128 -c eth0 -x

Dann auf dem Client im Browser folgenden Proxy eintragen

Host: localhost Port:8000

So kann man aus einem Netzwerk das einen Ping ins internet zulässt aber

keinen Zugriff per HTTP / HTTPs / FTP über einen ICMP Tunnel über

den Proxy auf dem "RootServer" doch surfen.