Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies?
Edit- What is the best way to detect unauthorized outgoing VPN connections while they are in process or after they have occurred? I assume there are software solutions?
This is a risk-management thing. As @tylerl mentioned, if the only parameter is to stop people from opening tunnels, then blocking everything is the way to go.
In the real world, you need to weigh the risks and benefits.
I prefer a well communicated Acceptable Use Policy + firewall rules + blacklists + traffic statistics. It will block the honest and slightly dishonest workers. For the dishonest techies, look for long open sessions, unusually high amounts of encrypted traffic, or after-hours communications to/from machines in the end-user networks.
You're still open to the risk of people using tunnels for small amounts of data, but they still have USB keys, ipods and cellphones right?
No.
Well, yes, but probably not the way you're thinking. You'd have to block all outbound traffic by default, and then white-list only the outside hosts (not ports, not services) which you can guarantee won't be usable to bounce traffic (generally because they are also similarly restricted).
If you wanted to block all traffic types that for which tools already exist for relaying VPN traffic, you'd have to block HTTP, HTTPS, and DNS among other things, making your internet connection almost useless.
There is no way you could easily block a skilled technical user from accessing things through your firewall.
Many networks limit outside traffic to just http and https, having their own internal DNS and email servers which are exempt from that policy. This makes it more difficult to get around, but still not impossible.
As an example, I often connect to my home server from hotels and free wireless places using Putty and ProxyTunnel. It appears to just be normal HTTPS traffic, but really tunnels SSH traffic, which in turn tunnels anything I want. The same can be done over regular HTTP.
Stopping users from getting around the firewall doesn't really have a technological solution. You are best off having a clear acceptable usage policy, with clear penalties for violating it (depending on the severity of the violation, anything from a verbal or written warning up to being terminated on the spot may be appropriate) and actually ENFORCING it.
Explaining to users WHY things are blocked is sometimes helpful too. If for example you are blocking streaming music because the site has a very limited internet connection and it slows things down, tell the users that. Knowing there's an actual reason behind it beyond "we just don't want you to" goes a long way towards stopping people from trying to get around it.
At the same time make sure you don't block so much that it starts interfering with their job. I've worked at places that blocked website by keywords that made completely relevant and necessary websites off limits. So what should have been 5 minutes of research turn into hours or days of trying to get a site unblocked.
Depends on the type of VPN connection, really. If its an IPsec tunnel, then blocking port 500 may do the trick. This is the default port used by IKE. If its an SSL VPN, then you probably need an application layer firewall that can do signature based traffic filtering. You would also need to proxy HTTPS connections (basically a man-in-the-middle setup). Otherwise, you won't be able to see the encrypted traffic.
well if you shut down protocol 47(GRE) this will stop most vpns being able to transfer data. as 99% of vpn's will use the above protocol
On mikrotik routers or cisco this should be easy and you can also see if any vpns make it through. either way you could block all vpn ports 4500,500,1723 and 47(GRE) just tell it if the dst address = 192.168../24 (your network address) and protocol = 47(gre) drop packets
