2

I have some questions about squid proxies, we set a squid proxy server to block certain web sites for users. and some users only can access one website that related to our work.but after install some VPN software it can bypass squid proxy server. and access all web sites that blocked by squid how this happen ?

i don't have good knowledge about how squid proxy working and how VPN software tunneling through the squid proxy, I really want to know how those things happen.

Improve this question
7
  • I think this really depends on how Cyberghost is routing you, and at what point the server admins can see the traffic.
    – RoraΖ
    Commented Aug 20, 2014 at 13:37
  • At a minimum they'll see a brand new encrypted channel on their network. They might not be able to tell who is using it or what sites you're visiting, but the network traffic will be different.
    – RoraΖ
    Commented Aug 20, 2014 at 13:43
  • 3
    Just a heads up, often bypassing office policy (I.E. using a VPN without permission to bypass censors) is a terminable offence. Might want to be very careful.
    – Chris Murray
    Commented Aug 20, 2014 at 13:59
  • our network also firewalled using juniper netscreen 25 , it is possible to track me in firewall ?
    – sameera
    Commented Aug 20, 2014 at 15:05
  • @SemiraUthsala - YES! If I were your network admin you'd already have been escorted out of the building. That may yet happen to you next time they review the logs.
    – James Snell
    Commented Aug 23, 2014 at 9:37

2 Answers 2

Reset to default
1

1) Part of the answer depends a lot on the kind of company you work for. I used to work at a Fortune 100 defense contractor, and I can tell you any decent IT system will red flag unknown encrypted data leaving the company network in a heartbeat. They're not looking for someone accessing blocked sites, but that kind of activity can look a lot like a sophisticated attacker has compromised the company network and is stealing data. That kind of attention will get you terminated.

2) Most companies routinely install monitoring software on company devices. It's cheap, effective at keeping employees inline, and it's a great way to document 'cause for termination' when you want to fire someone. So, you should assume they can see everything on your screen, and log everything you type at any time. All they need is a reason to come looking.

In short, most companies will terminate you pretty fast for pulling something like this. It's not a matter of if you'll get caught, but when. So, you'd better be sure watching youtube (or whatever you're up to) is worth loosing your job over.

Improve this answer
0
1

The VPN software most likely uses a CONNECT request which allows passing raw data through the proxy without interception - that's what's used to make HTTPS go through HTTP proxies without any TLS errors nor additional certificates.

In this case your sysadmin sees a connection to your VPN server (most likely on port 443 since most other ports are blocked by default because they aren't needed on an HTTP proxy) with a lot of data going through it; the proxy can't decrypt that data by itself but if you're using your company's PC there may be some monitoring software installed on it that allows them to look at what you're doing no matter what tunneling software you use.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .