Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic?

In order to access SSL websites you need port 443 open but if you setup a VPN Service on port 443 you can dial out of the firewall.

share|improve this question
add comment

2 Answers

Yes. Even if you run a VPN on port 443, HTTPS (which uses port 443) and VPNs have enough differences within the protocols that can be distinguished from the outside that a firewall or device that does deep packet inspection would be able to immediately classify both.

If your firewall does not block a VPN connection on port 443, it is likely that the firewall is only doing port filtering, or does not have protocol signatures for VPN connections yet.

share|improve this answer
    
You're assuming that the firewall is capable of deep packet inspection, and that the client is willing to trust its certificate. –  Bruno Sep 23 '13 at 12:57
    
@Bruno: I covered the case where the firewall does not do DPI in the second paragraph of my answer. Also, "client is willing to trust its certificate"? Doesn't that apply to MITM, and not determining the protocol type? –  Nasrus Oct 7 '13 at 15:31
    
Sure, but to determine the protocol type (e.g HTTPS or VPN over SSL/TLS), you need to look within the SSL/TLS channel, hence you need a "MITM proxy/firewall", hence the client needs to accept this MITM by accepting its certificate. –  Bruno Oct 7 '13 at 16:05
    
Most VPN protocols, such as IPSec and OpenVPN without tunneling through SSL, have differences in the protocols that can be determined from an onlooker doing proper DPI without needing to do an MITM. Even if tunneled through SSL, a router doing DPI with the appropriate rulesets can detect "unnatural" SSL connections, such as those that have the client provide a certificate to prove its identity, or unusually long connection times with massive traffic flows. –  Nasrus Oct 8 '13 at 0:13
    
IPSec is over UDP, so couldn't be confused with HTTPS anyway. I'm not sure whether OpenVPN with SSL/TLS starts with other packets first; if it doesn't it would look like plain SSL/TLS (just like HTTPS). Client-certs can legitimately happen with an HTTPS connection (although they wouldn't work with a MITM proxy anyway), and they can be "hidden" (in a renegotiated handshake). The only "reliable" way to detect non-HTTPS SSL/TLS traffic on TCP port 443 really is the long connection time... –  Bruno Oct 8 '13 at 0:20
show 1 more comment

If you can configure your VPN to first connect via TCP port 443 and then secure the comms under SSL (actually use TLS) and only then utilize the VPN protocol... then finally you would prevent the firewall from being able to detect that it is VPN traffic instead of HTTP traffic.

Stated another way, plaintext VPN traffic over 443 will look like VPN traffic, matching whatever protocol in use. SSL VPN traffic over 443 will look like SSL traffic.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.