7

Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies?

Edit- What is the best way to detect unauthorized outgoing VPN connections while they are in process or after they have occurred? I assume there are software solutions?

Improve this question
1
  • 2
    You might also want to consider why people create such VPNs. Are there aspects of the policy that should be improved, or should the existing policy update process be improved? Non-compliance often is a prime response to security measures that prevent productivity (see discovery.ucl.ac.uk/1389948).
    – Steve Dodier-Lazaro
    May 12, 2015 at 23:18

5 Answers 5

Reset to default
8

This is a risk-management thing. As @tylerl mentioned, if the only parameter is to stop people from opening tunnels, then blocking everything is the way to go.

In the real world, you need to weigh the risks and benefits.

I prefer a well communicated Acceptable Use Policy + firewall rules + blacklists + traffic statistics. It will block the honest and slightly dishonest workers. For the dishonest techies, look for long open sessions, unusually high amounts of encrypted traffic, or after-hours communications to/from machines in the end-user networks.

You're still open to the risk of people using tunnels for small amounts of data, but they still have USB keys, ipods and cellphones right?

Improve this answer
2
  • "For the dishonest techies, look for long open sessions, unusually high amounts of encrypted traffic, or after-hours communications to/from machines in the end-user networks." - Can you make suggestions about software to monitor for these criteria?
    – Hannibal
    Jan 30, 2012 at 17:14
  • 1
    Check to see if your firewall is already generating traffic statistics or capable of it. If not, then something like ntop would work ntop.org/products/ntop . What you use depends on how complex your environment is.... BTW, the software isn't monitoring for the criteria, you're putting the checks in your monthly or weekly procedures. For real time monitoring, unless you write your own scripts, the only tools I'm aware of are commercial SIEMs... big bucks.
    – mgjk
    Jan 30, 2012 at 18:50
9

No.

Well, yes, but probably not the way you're thinking. You'd have to block all outbound traffic by default, and then white-list only the outside hosts (not ports, not services) which you can guarantee won't be usable to bounce traffic (generally because they are also similarly restricted).

If you wanted to block all traffic types that for which tools already exist for relaying VPN traffic, you'd have to block HTTP, HTTPS, and DNS among other things, making your internet connection almost useless.

Improve this answer
9
  • Is there anyway to detect this traffic? Does this not present a substantial network vulnerability?
    – Hannibal
    Jan 27, 2012 at 17:03
  • 5
    If your security policy is based around the idea of controlling Internet traffic, then you need to re-think your security policy. You can't build a wall around the edge of your network and assume that everything inside will stay safe.
    – tylerl
    Jan 27, 2012 at 17:22
  • My question was very specific and didn't give enough information to form an opinion about my security policy. This vulnerability showed up during my own testing and odds are if I can do it someone else can too and I wanted to get more information to see if it can be stopped or detected.
    – Hannibal
    Jan 30, 2012 at 17:10
  • I'll just bring in a 4G USB card and build a tunnel that way if you're going to let malicious people inside your network.
    – StrangeWill
    Jan 30, 2012 at 18:00
  • 1
    So if I were connected to your network, you're saying that you have a security policy in place that wouldn't prevent me from using a VPN tunnel undetected to download pirated content from a torrent site that has a nice juicy virus? And once I did it would present no danger? Or are you saying that you would just trust me to follow your AUP? I am just trying to wrap my head around the idea that a user having the ability to skirt network policy unchecked and undetected is NOT a vulnerability. Can you point me to a resource that would provide more information to clarify your point of view?
    – Hannibal
    Jan 31, 2012 at 16:31
4

There is no way you could easily block a skilled technical user from accessing things through your firewall.

Many networks limit outside traffic to just http and https, having their own internal DNS and email servers which are exempt from that policy. This makes it more difficult to get around, but still not impossible.

As an example, I often connect to my home server from hotels and free wireless places using Putty and ProxyTunnel. It appears to just be normal HTTPS traffic, but really tunnels SSH traffic, which in turn tunnels anything I want. The same can be done over regular HTTP.

Stopping users from getting around the firewall doesn't really have a technological solution. You are best off having a clear acceptable usage policy, with clear penalties for violating it (depending on the severity of the violation, anything from a verbal or written warning up to being terminated on the spot may be appropriate) and actually ENFORCING it.

Explaining to users WHY things are blocked is sometimes helpful too. If for example you are blocking streaming music because the site has a very limited internet connection and it slows things down, tell the users that. Knowing there's an actual reason behind it beyond "we just don't want you to" goes a long way towards stopping people from trying to get around it.

At the same time make sure you don't block so much that it starts interfering with their job. I've worked at places that blocked website by keywords that made completely relevant and necessary websites off limits. So what should have been 5 minutes of research turn into hours or days of trying to get a site unblocked.

Improve this answer
1
  • Having to deal with websites that are blocked because of keyword and/or the website is a blog is a huge pain to deal with.
    – Ramhound
    Jan 31, 2012 at 13:40
2

Depends on the type of VPN connection, really. If its an IPsec tunnel, then blocking port 500 may do the trick. This is the default port used by IKE. If its an SSL VPN, then you probably need an application layer firewall that can do signature based traffic filtering. You would also need to proxy HTTPS connections (basically a man-in-the-middle setup). Otherwise, you won't be able to see the encrypted traffic.

Improve this answer
2
  • 1
    Actually there still would be ways like DNS and HTTP tunneling. Even when using a proxy.
    – Lucas Kauffman
    Jan 28, 2012 at 6:47
  • That's certainly true. Someone who is determined will find a way. But I'm speaking from the perspective of the 80/20 rule. 80% of people will be deterred by the recommendation I made.
    – Jason Huebel
    Feb 10, 2012 at 3:39
-1

well if you shut down protocol 47(GRE) this will stop most vpns being able to transfer data. as 99% of vpn's will use the above protocol

On mikrotik routers or cisco this should be easy and you can also see if any vpns make it through. either way you could block all vpn ports 4500,500,1723 and 47(GRE) just tell it if the dst address = 192.168../24 (your network address) and protocol = 47(gre) drop packets

Improve this answer
2
  • Do you mean port 47 and not protocol 47?
    – Neil Smithline
    Nov 9, 2015 at 21:21
  • GRE is a protocol within the Internet Protocol suite, just like TCP (6) or UDP (17). Here's a nice little list of IP protocols: Protocol Numbers. Blocking ESP (50) would also be a good idea.
    – Jason Huebel
    May 17, 2016 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.