5

So I am at a coffee shop and trying to connect to my VPN (the VPN is configured just fine) but the service seems to be disabled by the coffee shop's network. How can a coffee shop block VPN connections? Are they blocking a list of known VPN IPs or are they blocking the protocol altogether?

I've also posted a question about how to get around whatever restrictions are in place.

2 Answers 2

4

It can be either. Technically speaking one can block

  • a remote IP
  • a remote port
  • a specific pattern of traffic

Even though VPN connections are encrypted and if you choose a non-descriptive IP and port, someone can still rely on the traffic pattern. This is not foolproof and heavily depends on the protocol but for instance OpenVPN is blockable this way (the way it initializes its connection (the "handshake") is specific).

The pattern filtering is available on higher-end equipment so I would guess that the filtering will be on the port. The blacklist is not simple to maintain so it is less likely.

It can also be that only some ports are allowed (HTTP and HTTPS usually) so anything else (including your VPN) is rejected.

3
  • Hm ok, is there a way to detect which method they are using?
    – user118923
    Jul 29, 2016 at 16:50
  • Except for trying, no. You can try to connect to a VPN on a non-descriptive IP and/or IP to rule out an IP filtering. If you still cannot connect then they have behavioral filtering (something which is much harder to circumvent when it works)
    – WoJ
    Jul 29, 2016 at 16:57
  • So, as it turns out governments like Iran do block and throttle VPN services (OpenVPN, OpenConnect, Cisco AnyConnect, etc.) based on traffic patterns. Dec 18, 2018 at 20:01
0

It is obvious firewalling practice : Block everything, only open port you want.

Just open http(80) and https (443) is enough to server most of the internet traffics.

4
  • You say obviously but how can you know? Can I test for this?
    – user118923
    Jul 29, 2016 at 18:00
  • I'm not entirely sure what you mean... It is my understanding that I may not simply 'ping' each port because ping might be disabled for one (legal for another)
    – user118923
    Jul 29, 2016 at 18:02
  • @user118923 : Please read en.wikipedia.org/wiki/Firewall_(computing) for background knowledge. In plain English, firewall is similar to a electronic door that required identity verification. It is easier to implement rules to STOP EVERYONE, but allow specific entry. You can do TCP port scan to "proof" this (port 1 to 65535) , however, some firewall may disconnect you when there is a rules to detect flood of port scanning .
    – mootmoot
    Aug 1, 2016 at 8:16
  • The port is not an indication of the actual traffic (it is just a hint / tradition). One can have a VPN server set to listen on port 443 for instance.
    – WoJ
    Dec 18, 2018 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.