Slashdot Mirror
Video Conferencing Behind a Firewall?
JShadow21 asks: "I work at a research lab at a hospital. We want to collaborate with colleagues across the pond via video conferencing however the firewall here is very restrictive. There are way too many ports that needed to be opened for H.323 to work so the IT guys won't do that. What alternatives are there? I was considering using an SSH proxy in order to use Netmeeting, or else possibly a web based solution."
The Netmeeting rules in our PIX configs need only 5 TCP ports: LDAP, 522, 1503, h323 1731. If you know the IPs of the remote side you can open up a very restrictive set of holes for incoming "calls" or you can initiate the connections and not worry about opening up incoming holes altogether (if you use NAT/PAT this is easiest.)
Remember: your IT guys aren't running the show, they're there to help you do your job (and I'm an IT weenie at a research lab where Netmeetings are not uncommon...)
Trolling is a art,
I would have to recommend NetMeeting...it's easy to implement, and is already installed on your Windows machines. However, there are quite a few ports that need to be opened...to ensure smooth passage through the firewall, I recommend you take your IT guy to lunch at your local watering hole to discuss it. ^_^
Seriously, though, the opening of these ports should prove to be a minimal security risk if done correctly. A firewall admin who won't open any ports is a firewall admin who doesn't know how to do his job (Ford Motor Company's firewall boys spring to mind here). Remember, this is a valid request you're making, and implementing that request in a safe and secure manner is their job.
____
~ |rip/\/\aster /\/\onkey
Select a machine somewhere to be a dedicated video conference server and have everybody VPN into that machine. Then all those crazy h.whatever ports should be fine.
-73, de n1ywb
www.n1ywb.com
you only need to allow in H323. On any recent pix, that's just one ACL entry.
Access-list incoming tcp host blah eq h323 any
if you want to be more secure, change the any to the IP of the device calling you. I deal with this stuff all the time, it's really no big deal. Some devices, like tandberg, use extra ports (5555) for other purposes. You might also need LDAP for directory services. If you get an appliance based VC unit instead of a PC based one, you'll be slightly more secure.
Additionally, if you want to be more secure, Polycom makes units that use AES encryption for the actual video/audio stream.
Do what I do at home! Set your videoconferencing computer's IP address to be in the DMZ (demillitarized zone)!
Hey, it works for bit torrent....
moox. for a new generation.
we use http://www.webex.com/ at our work, works a treat behind a multitude of firewalls and maybe even proxies if I remember rightly.
:)
you should check it out
-- If I were a fish, I'd be wet
One possibility would be to use a separate, dedicated local network, possibly just one machine sitting by its lonesome. That machine should still be firewalled, especially outbound, and your local network shouldn't trust it at all. Ideally, you'd set it to only be able to reach the networks of whoever you're collaborating with, but if that's likely to change frequently, you may have to open it up to the world.
If your hospital provides network services to the outside world, it's likely that your IT group will already have implemented the separate-network idea... it's generally called a 'DMZ'. If they already have one, it should be easy to run a wire to a certain, specific machine, ideally one in a conference room. And they'll want to lock down the port so it will only talk to that machine, so that visitors or staff don't try to use the DMZ net by mistake. (Some outfits treat the DMZ as already compromised, so if you connect to it by mistake, your machine is declared untrusted, wiped, and reloaded. Not a lot of fun for anyone involved. Most places aren't that anal, though perhaps they should be.)
Setting up a machine in an existing DMZ will involve some work on the part of the IT crew. If they're creating a DMZ from scratch, it could potentially be quite a bit of work. If they're jammed, they may not have any brainpower free to help you with it.
If they can't help you, but you have some budget and live in a big city, you could potentially hook up via a laptop and one of the high-speed cell data networks. In many areas of the country, this is fast enough to be perfectly functional, and you shouldn't need much help getting it running.
However, if you do this without IT's blessing, you should NEVER AGAIN connect that machine to their network... with that data card in it, that machine can potentially be a back door straight into their systems. If you have any VPN software on that machine with credentials to connect to your network, remove it. Before you plug in the cell card, turn it completely into a standalone system, and make sure that all the passwords are different than any others used on any of your other networks, including your home machines. You are assuming that it WILL be compromised, and you're doing your level best to make sure that there's no data on the machine you care about, nor any sensitive passwords that could give an attacker a wedge into your corporate network.
Remember, even if you pull the card out, the machine could already be compromised, so connecting it to the internal network could let it 'phone home' to a hacker and give him full access to your systems. So it should never again be connected to the work network in any way, shape, or form. You should always think of it as already compromised.... dangerous and radioactive. This may or may not be actually TRUE, but it's not a bad habit to be in, especially when you're not an expert.
Disable the Ethernet port so you remember that you don't trust that machine. If you need to move data, burn a CD and sneakernet it. Turn the machine off when you're not using it.
If you don't have the technical chops to lock it down well, wipe and reload it on a fairly regular basis. Use new passwords every time.
I don't recommend you do this for a whole bunch of reasons (not the least of which is the potential of getting fired), but if you can't get IT to help you, setting up a cell card like this should be pretty safe. Just make SURE that it knows NOTHING about your internal net before hooking it up.
Even if IT is otherwise busy, they might be able to give you a 'clean' machine that you can do whatever you want with.
There are several smart proxy firewalls on the market that understand H.323, and will only allow secondary connections as specifically negotiated within the primary connection, thus essentially eliminating the "too many ports" objection. There are probably others, but I know that at least Secure Computing's Sidewinder G2, some of Cyberguard's product lines, and the Symantec Enterprise Firewall offer H.323 proxies.
Since I work for one of these companies I'm posting AC.
OpenVPN is Free (in both senses), fairly fast, cross-platform, but most of all easy to setup. Tunnel all traffic through a single, CONFIGURABLE port. My IT department is also often inept & they're packet-shaper makes most VPN traffic crawl (as if it were P2P or something). We require fast remote control software to be run, so we put it on port 80 & watched the traffic finally fly along.
... it's not a videoconferencing software, but it sets up vpn groups. every client get's an own additional ip and the software got around every firewall/nat I used it. plus the streams are encrypted and transfered via p2p.
give it a try: http://www.hamachi.cc/
and use your prefered video conferencing software with it.
I am currently streaming my music from my office machine to my home computer. both behind firewalls and routers.
btw. it's windows only.
I'm sorry. You said your professional development requires you to video conference. Who the #^%&#! do your IT guys think they are! Go to your hospital administrators and show (don't tell) them how your hospital's jack-booted IT nazi's are keeping you from doing your job.
I have worked in environments where the IT guys forgot they provide a network for the people to use in their jobs, not a network that they can use to build their own personal fiefdom! The best way to break this GOD complex is to have the IT guys boss get his ass chewed by the higher ups.
The IT guys can solve your video conferencing problem in one of many ways. There job is to figure out how to make it happen not tell you it's not going to happen.
The next time one of these IT weenies gets hurt on the job tell them you can't administer medical treatment because you have to maintain a firewall between them and you.
probably the easiest is to convince IT that the people you want to conference with are trustworthy and get them VPN access. Once they're in, you can do whatever you want.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Works fine for me ... they route all the traffic though the Yahoo! servers if you cannot establish a direct connection, and it's free!
There is a Linux client AFAIK, a friend of mine runs it on his CS server.
h readid=1619003
There was also a thread on somethingawful yesterday about this Himachi thing, according to a lot of people it does kicks some major ass.
http://forums.somethingawful.com/showthread.php?t
Depending on your usage and the firewall, you may be able to get by with using a h.323 proxy server.
...etc.) we care about and not the images of bored people.
This will allow outgoing h.323 connections, but not incoming ones. If you're only connecting to external h.323 servers/nodes and not hosting things inside your firewall, this would work transparently.
On an implementation here, we added a h.323 proxy server to our firewall and set up a video conferencing server outside the firewall.
The conferenceing server could be controlled via a web interface to start a conference, then remote and local clients alike would connect to this server for their conference without having to pass any incoming connections through the firewall.
We found that unless you get some sort of QOS routing by your ISP, the audio latency made the conferencing more annoying than helpful. This led to people going back to conference call for the audio portion, and then realizing that it wasn't worth the effort to set up a corresponding video conference just to get a picture of the talking head to match the phone conference.
We've now transitioned to a combination of phone conferencing and Webex. Webex just shares the "stuff" (presentations, files, notes,
Tanberg offers an easy solution with its gate keep... only requires a small number of ports to open, the gate keeper tracks these. Another solution, cheaper and easier by far, ONT offers a video conferencing software, only requires port 80 or 443.
Gnu Gatekeeper can do the job to you; it can be used like a traditional gatekeeper or like a proxy also; from FAQ:
"1.2. Can I use the GNU Gatekeeper for NAT/masquerading H323 calls through a firewall ?
Use the proxy function that has been introduced in version 2.0."
from manual:
"When Gatekeeper Routed call signalling is used, the gatekeeper may choose whether to route the H.245 control channel and logical channels.
Case I.
The gatekeeper doesn't route them. The H.245 control channel and logical channels are established directly between the endpoints.
Case II.
The H.245 control channel is routed between the endpoints through the gatekeeper, while the logical channels are established directly between the endpoints.
Case III.
The gatekeeper routes the H.245 control channel, as well as all logical channels, including RTP/RTCP for audio and video, and T.120 channel for data. In this case, no traffic is passed directly between the endpoints. This is usually called an H.323 Proxy, which can be regarded as an H.323-H.323 gateway. "
http://www.gnugk.org/
Stay away from Tandberg. I cannot speak about their entire product line, but some of their h323 devices are extremely buggy. I know this first hand because I worked on firewall ALG module for H.323 and Tandberg devices caused us all sorts of grief. To give an idea - they had no problem negotiating one port and then start streaming over the +2 one. Freaky stuff, cant imagine them being interoperable with anything but themselves.
Disclaimer: I don't work for Tandberg and I have never used this product. I looked into it when researching a project. It is not cheap. Take my comments with a grain of salt and do your own research.
Still, with a plan, you only get the best you can imagine. I'd always hoped for something better than that. -CP
Its my job when someone comes to me with something like that. To look at it and if i dont want to do it there way to offer an alternative. Your tech guys are gonna need a kick (try confiscating their bandwidth till they do some work).
They fitted George Orwell's coffin with rollers so he could turn over more easily years ago.
This so-called DMZ offered by home routers is a terrible breach of security!!!
You might try a host solution like microsoft live meeting or lotus sametime or webex, basically anything that is hosted on a website instead of using direct p2p connection.
Also assuming the other person isn't behind a firewall you could call out to them using netmeeting.