change cipher spec encrypted handshake message - page blocked internal

Question

Hello, first time posting here. Not exactly sure the protocol on what to post I shall do my best.

I've got an HR user that connects to a secure website:

https://sbsftp.benefitfocus.com/

When I give my laptop public IP and try from outside firewall the connection works, and wireshark says:

82  6.152399000 74.213.141.49   **MachinePublicIP** TCP 60  443→54768 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
96  8.009220000 74.213.141.49   **MachinePublicIP** TCP 62  443→55209 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1380 SACK_PERM=1

followed by server hello, certificate, client key exchange, then packets that look like this

108 8.120849000 74.213.141.49   **MachinePublicIP** TLSv1   725 Application Data, Application Data, Encrypted Alert

When I try from inside, browser gives 'err-connection-closed' error and will not connect.

I get this from wireshark RED row(s)

262 9.656649000 74.213.141.49   **MachineinternalIP**   TCP 60  443→53427 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

followed by similar packets - the port 443->53427 - the second number increments with each error.

Thanks for any help!

Brent

Answer 1

It seems you are still using the public IP on your laptop when connecting from inside? That's what the text you posted shows (74.213.141.49 used in both cases).

The "error" case you show looks like your client is closing the connection, what was the URL you used in the "internal" case? If it's the "internal IP" of the server, then it's likely not to match the info in the server certificate and so the client will close the connection. This is more likely if the RST occurs after receipt of the server certificate.

Update:

OK I misread the text, thinking that packet was the client SYN, but it's obviously the server SYN ACK back. Yet more proof that analysis by text snippet is awkward.

So the server is issuing the RST, this makes me think it's more likely that something in the network path from the client to the server (router or server itself) is configured to reject connection attempts to the external IP from an internal route.

Note: Analysing issues using portions of text output is a bit of guesswork, much better to post a capture somewhere publically (cloudshark, Google Drive, Dropbox etc.), using an anonymiser such as TraceWrangler if necessary.