Slashdot Mirror
Video Conferencing Behind a Firewall?
JShadow21 asks: "I work at a research lab at a hospital. We want to collaborate with colleagues across the pond via video conferencing however the firewall here is very restrictive. There are way too many ports that needed to be opened for H.323 to work so the IT guys won't do that. What alternatives are there? I was considering using an SSH proxy in order to use Netmeeting, or else possibly a web based solution."
The Netmeeting rules in our PIX configs need only 5 TCP ports: LDAP, 522, 1503, h323 1731. If you know the IPs of the remote side you can open up a very restrictive set of holes for incoming "calls" or you can initiate the connections and not worry about opening up incoming holes altogether (if you use NAT/PAT this is easiest.)
Remember: your IT guys aren't running the show, they're there to help you do your job (and I'm an IT weenie at a research lab where Netmeetings are not uncommon...)
Trolling is a art,
I would have to recommend NetMeeting...it's easy to implement, and is already installed on your Windows machines. However, there are quite a few ports that need to be opened...to ensure smooth passage through the firewall, I recommend you take your IT guy to lunch at your local watering hole to discuss it. ^_^
Seriously, though, the opening of these ports should prove to be a minimal security risk if done correctly. A firewall admin who won't open any ports is a firewall admin who doesn't know how to do his job (Ford Motor Company's firewall boys spring to mind here). Remember, this is a valid request you're making, and implementing that request in a safe and secure manner is their job.
____
~ |rip/\/\aster /\/\onkey
Select a machine somewhere to be a dedicated video conference server and have everybody VPN into that machine. Then all those crazy h.whatever ports should be fine.
-73, de n1ywb
www.n1ywb.com
you only need to allow in H323. On any recent pix, that's just one ACL entry.
Access-list incoming tcp host blah eq h323 any
if you want to be more secure, change the any to the IP of the device calling you. I deal with this stuff all the time, it's really no big deal. Some devices, like tandberg, use extra ports (5555) for other purposes. You might also need LDAP for directory services. If you get an appliance based VC unit instead of a PC based one, you'll be slightly more secure.
Additionally, if you want to be more secure, Polycom makes units that use AES encryption for the actual video/audio stream.
Do what I do at home! Set your videoconferencing computer's IP address to be in the DMZ (demillitarized zone)!
Hey, it works for bit torrent....
moox. for a new generation.
we use http://www.webex.com/ at our work, works a treat behind a multitude of firewalls and maybe even proxies if I remember rightly.
:)
you should check it out
-- If I were a fish, I'd be wet
One possibility would be to use a separate, dedicated local network, possibly just one machine sitting by its lonesome. That machine should still be firewalled, especially outbound, and your local network shouldn't trust it at all. Ideally, you'd set it to only be able to reach the networks of whoever you're collaborating with, but if that's likely to change frequently, you may have to open it up to the world.
If your hospital provides network services to the outside world, it's likely that your IT group will already have implemented the separate-network idea... it's generally called a 'DMZ'. If they already have one, it should be easy to run a wire to a certain, specific machine, ideally one in a conference room. And they'll want to lock down the port so it will only talk to that machine, so that visitors or staff don't try to use the DMZ net by mistake. (Some outfits treat the DMZ as already compromised, so if you connect to it by mistake, your machine is declared untrusted, wiped, and reloaded. Not a lot of fun for anyone involved. Most places aren't that anal, though perhaps they should be.)
Setting up a machine in an existing DMZ will involve some work on the part of the IT crew. If they're creating a DMZ from scratch, it could potentially be quite a bit of work. If they're jammed, they may not have any brainpower free to help you with it.
If they can't help you, but you have some budget and live in a big city, you could potentially hook up via a laptop and one of the high-speed cell data networks. In many areas of the country, this is fast enough to be perfectly functional, and you shouldn't need much help getting it running.
However, if you do this without IT's blessing, you should NEVER AGAIN connect that machine to their network... with that data card in it, that machine can potentially be a back door straight into their systems. If you have any VPN software on that machine with credentials to connect to your network, remove it. Before you plug in the cell card, turn it completely into a standalone system, and make sure that all the passwords are different than any others used on any of your other networks, including your home machines. You are assuming that it WILL be compromised, and you're doing your level best to make sure that there's no data on the machine you care about, nor any sensitive passwords that could give an attacker a wedge into your corporate network.
Remember, even if you pull the card out, the machine could already be compromised, so connecting it to the internal network could let it 'phone home' to a hacker and give him full access to your systems. So it should never again be connected to the work network in any way, shape, or form. You should always think of it as already compromised.... dangerous and radioactive. This may or may not be actually TRUE, but it's not a bad habit to be in, especially when you're not an expert.
Disable the Ethernet port so you remember that you don't trust that machine. If you need to move data, burn a CD and sneakernet it. Turn the machine off when you're not using it.
If you don't have the technical chops to lock it down well, wipe and reload it on a fairly regular basis. Use new passwords every time.
I don't recommend you do this for a whole bunch of reasons (not the least of which is the potential of getting fired), but if you can't get IT to help you, setting up a cell card like this should be pretty safe. Just make SURE that it knows NOTHING about your internal net before hooking it up.
Even if IT is otherwise busy, they might be able to give you a 'clean' machine that you can do whatever you want with.
OpenVPN is Free (in both senses), fairly fast, cross-platform, but most of all easy to setup. Tunnel all traffic through a single, CONFIGURABLE port. My IT department is also often inept & they're packet-shaper makes most VPN traffic crawl (as if it were P2P or something). We require fast remote control software to be run, so we put it on port 80 & watched the traffic finally fly along.
... it's not a videoconferencing software, but it sets up vpn groups. every client get's an own additional ip and the software got around every firewall/nat I used it. plus the streams are encrypted and transfered via p2p.
give it a try: http://www.hamachi.cc/
and use your prefered video conferencing software with it.
I am currently streaming my music from my office machine to my home computer. both behind firewalls and routers.
btw. it's windows only.
I'm sorry. You said your professional development requires you to video conference. Who the #^%&#! do your IT guys think they are! Go to your hospital administrators and show (don't tell) them how your hospital's jack-booted IT nazi's are keeping you from doing your job.
I have worked in environments where the IT guys forgot they provide a network for the people to use in their jobs, not a network that they can use to build their own personal fiefdom! The best way to break this GOD complex is to have the IT guys boss get his ass chewed by the higher ups.
The IT guys can solve your video conferencing problem in one of many ways. There job is to figure out how to make it happen not tell you it's not going to happen.
The next time one of these IT weenies gets hurt on the job tell them you can't administer medical treatment because you have to maintain a firewall between them and you.
probably the easiest is to convince IT that the people you want to conference with are trustworthy and get them VPN access. Once they're in, you can do whatever you want.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Tanberg offers an easy solution with its gate keep... only requires a small number of ports to open, the gate keeper tracks these. Another solution, cheaper and easier by far, ONT offers a video conferencing software, only requires port 80 or 443.
Gnu Gatekeeper can do the job to you; it can be used like a traditional gatekeeper or like a proxy also; from FAQ:
"1.2. Can I use the GNU Gatekeeper for NAT/masquerading H323 calls through a firewall ?
Use the proxy function that has been introduced in version 2.0."
from manual:
"When Gatekeeper Routed call signalling is used, the gatekeeper may choose whether to route the H.245 control channel and logical channels.
Case I.
The gatekeeper doesn't route them. The H.245 control channel and logical channels are established directly between the endpoints.
Case II.
The H.245 control channel is routed between the endpoints through the gatekeeper, while the logical channels are established directly between the endpoints.
Case III.
The gatekeeper routes the H.245 control channel, as well as all logical channels, including RTP/RTCP for audio and video, and T.120 channel for data. In this case, no traffic is passed directly between the endpoints. This is usually called an H.323 Proxy, which can be regarded as an H.323-H.323 gateway. "
http://www.gnugk.org/
Disclaimer: I don't work for Tandberg and I have never used this product. I looked into it when researching a project. It is not cheap. Take my comments with a grain of salt and do your own research.
Still, with a plan, you only get the best you can imagine. I'd always hoped for something better than that. -CP
Its my job when someone comes to me with something like that. To look at it and if i dont want to do it there way to offer an alternative. Your tech guys are gonna need a kick (try confiscating their bandwidth till they do some work).
They fitted George Orwell's coffin with rollers so he could turn over more easily years ago.
You might try a host solution like microsoft live meeting or lotus sametime or webex, basically anything that is hosted on a website instead of using direct p2p connection.
Also assuming the other person isn't behind a firewall you could call out to them using netmeeting.