Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies?

Edit- What is the best way to detect unauthorized outgoing VPN connections while they are in process or after they have occurred? I assume there are software solutions?

share|improve this question

4 Answers 4

up vote 6 down vote accepted

This is a risk-management thing. As @tylerl mentioned, if the only parameter is to stop people from opening tunnels, then blocking everything is the way to go.

In the real world, you need to weigh the risks and benefits.

I prefer a well communicated Acceptable Use Policy + firewall rules + blacklists + traffic statistics. It will block the honest and slightly dishonest workers. For the dishonest techies, look for long open sessions, unusually high amounts of encrypted traffic, or after-hours communications to/from machines in the end-user networks.

You're still open to the risk of people using tunnels for small amounts of data, but they still have USB keys, ipods and cellphones right?

share|improve this answer
    
"For the dishonest techies, look for long open sessions, unusually high amounts of encrypted traffic, or after-hours communications to/from machines in the end-user networks." - Can you make suggestions about software to monitor for these criteria? –  Hannibal Jan 30 '12 at 17:14
1  
Check to see if your firewall is already generating traffic statistics or capable of it. If not, then something like ntop would work ntop.org/products/ntop . What you use depends on how complex your environment is.... BTW, the software isn't monitoring for the criteria, you're putting the checks in your monthly or weekly procedures. For real time monitoring, unless you write your own scripts, the only tools I'm aware of are commercial SIEMs... big bucks. –  mgjk Jan 30 '12 at 18:50

No.

Well, yes, but probably not the way you're thinking. You'd have to block all outbound traffic by default, and then white-list only the outside hosts (not ports, not services) which you can guarantee won't be usable to bounce traffic (generally because they are also similarly restricted).

If you wanted to block all traffic types that for which tools already exist for relaying VPN traffic, you'd have to block HTTP, HTTPS, and DNS among other things, making your internet connection almost useless.

share|improve this answer
    
Is there anyway to detect this traffic? Does this not present a substantial network vulnerability? –  Hannibal Jan 27 '12 at 17:03
4  
If your security policy is based around the idea of controlling Internet traffic, then you need to re-think your security policy. You can't build a wall around the edge of your network and assume that everything inside will stay safe. –  tylerl Jan 27 '12 at 17:22
    
My question was very specific and didn't give enough information to form an opinion about my security policy. This vulnerability showed up during my own testing and odds are if I can do it someone else can too and I wanted to get more information to see if it can be stopped or detected. –  Hannibal Jan 30 '12 at 17:10
    
I'll just bring in a 4G USB card and build a tunnel that way if you're going to let malicious people inside your network. –  StrangeWill Jan 30 '12 at 18:00
1  
So if I were connected to your network, you're saying that you have a security policy in place that wouldn't prevent me from using a VPN tunnel undetected to download pirated content from a torrent site that has a nice juicy virus? And once I did it would present no danger? Or are you saying that you would just trust me to follow your AUP? I am just trying to wrap my head around the idea that a user having the ability to skirt network policy unchecked and undetected is NOT a vulnerability. Can you point me to a resource that would provide more information to clarify your point of view? –  Hannibal Jan 31 '12 at 16:31

There is no way you could easily block a skilled technical user from accessing things through your firewall.

Many networks limit outside traffic to just http and https, having their own internal DNS and email servers which are exempt from that policy. This makes it more difficult to get around, but still not impossible.

As an example, I often connect to my home server from hotels and free wireless places using Putty and ProxyTunnel. It appears to just be normal HTTPS traffic, but really tunnels SSH traffic, which in turn tunnels anything I want. The same can be done over regular HTTP.

Stopping users from getting around the firewall doesn't really have a technological solution. You are best off having a clear acceptable usage policy, with clear penalties for violating it (depending on the severity of the violation, anything from a verbal or written warning up to being terminated on the spot may be appropriate) and actually ENFORCING it.

Explaining to users WHY things are blocked is sometimes helpful too. If for example you are blocking streaming music because the site has a very limited internet connection and it slows things down, tell the users that. Knowing there's an actual reason behind it beyond "we just don't want you to" goes a long way towards stopping people from trying to get around it.

At the same time make sure you don't block so much that it starts interfering with their job. I've worked at places that blocked website by keywords that made completely relevant and necessary websites off limits. So what should have been 5 minutes of research turn into hours or days of trying to get a site unblocked.

share|improve this answer
    
Having to deal with websites that are blocked because of keyword and/or the website is a blog is a huge pain to deal with. –  Ramhound Jan 31 '12 at 13:40

Depends on the type of VPN connection, really. If its an IPsec tunnel, then blocking port 500 may do the trick. This is the default port used by IKE. If its an SSL VPN, then you probably need an application layer firewall that can do signature based traffic filtering. You would also need to proxy HTTPS connections (basically a man-in-the-middle setup). Otherwise, you won't be able to see the encrypted traffic.

share|improve this answer
1  
Actually there still would be ways like DNS and HTTP tunneling. Even when using a proxy. –  Lucas Kauffman Jan 28 '12 at 6:47
    
That's certainly true. Someone who is determined will find a way. But I'm speaking from the perspective of the 80/20 rule. 80% of people will be deterred by the recommendation I made. –  Jason Huebel Feb 10 '12 at 3:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.