Accessing embedded device behind firewall

This might be a place for corkscrew - Google for it. It contains a mechanism for tunneling over HTTP (S).

You could use OpenVPN. By default, OpenVPN uses port 1194 UDP, but you could choose port 80 TCP (i.e., http) if you prefer.

You should respect the customers wish for not having a constant connection. Have a button on the device, such that the customer can initiate a connection to your server in case a problem arises. You cannot expect the device to be able to connect any time. At least I would stop a device calling home at random intervals without a reason.

He did not say that the customer doesn't want a permanent connection, just that they don't want a port forwarded from their firewall and they only allow limited outgoing ports. He should, of course, check that the customer is happy with his box having a permanent connection through a VPN - presumably the customer's IT folk would not allow him to connect the box to their network at all until they are happy with it.

The OP said HTTP or HTTPS. OpenVPN cannot use them as carrier protocols. The default is UDP/1194.

Very probably, there is a HTTP(S) proxy, and the tool for it is corkscrew.

Since HTTPS is encrypted using SSL/TLS, there's no way for the firewall to tell the difference between HTTPS and any other protocol using SSL/TLS.

I use OpenVPN via an HTTPS proxy all the time. It works fine.

He said the http/https *ports* were open. OpenVPN cannot use http as a carrier. But it is perfectly possible to have OpenVPN use port 80 tcp, as long as it can get a direct connection. If there is a http proxy in the way, then it will of course cause trouble. It is therefore probably easier to use port 443 - proxies do not (because they *cannot*) cache or otherwise interfere with SSL traffic.

Or one of many other similar tools - the OP should have a look at what is available before deciding.

Of course, the customer has set up his firewall rules for a reason. Any system designed to get round these rules should be cleared with the customer before use.

There are, however, ways to tunnel IP through HTTP:

I've never tried it, and proxies can be set up to defeat such tunnelling

I can vouche for the fact that OpenVPN works fine with an https proxy.

Agreed. Under no circumstance should you do something like that at a customer site without the customer's approval. In writing. Assuming they're OK with your device phoning home, they'd probably rather open a hole in the firewall to a specific destination than turn you loose with a VPN/tunnelling setup.