So I am at a coffee shop and trying to connect to my VPN (the VPN is configured just fine) but the service seems to be disabled by the coffee shop's network. How can a coffee shop block VPN connections? Are they blocking a list of known VPN IPs or are they blocking the protocol altogether?

I've also posted a question about how to get around whatever restrictions are in place.


It can be either. Technically speaking one can block

  • a remote IP
  • a remote port
  • a specific pattern of traffic

Even though VPN connections are encrypted and if you choose a non-descriptive IP and port, someone can still rely on the traffic pattern. This is not foolproof and heavily depends on the protocol but for instance OpenVPN is blockable this way (the way it initializes its connection (the "handshake") is specific).

The pattern filtering is available on higher-end equipment so I would guess that the filtering will be on the port. The blacklist is not simple to maintain so it is less likely.

It can also be that only some ports are allowed (HTTP and HTTPS usually) so anything else (including your VPN) is rejected.

|improve this answer|||||
  • Hm ok, is there a way to detect which method they are using? – user118923 Jul 29 '16 at 16:50
  • Except for trying, no. You can try to connect to a VPN on a non-descriptive IP and/or IP to rule out an IP filtering. If you still cannot connect then they have behavioral filtering (something which is much harder to circumvent when it works) – WoJ Jul 29 '16 at 16:57
  • So, as it turns out governments like Iran do block and throttle VPN services (OpenVPN, OpenConnect, Cisco AnyConnect, etc.) based on traffic patterns. – codezombie Dec 18 '18 at 20:01

It is obvious firewalling practice : Block everything, only open port you want.

Just open http(80) and https (443) is enough to server most of the internet traffics.

|improve this answer|||||
  • You say obviously but how can you know? Can I test for this? – user118923 Jul 29 '16 at 18:00
  • I'm not entirely sure what you mean... It is my understanding that I may not simply 'ping' each port because ping might be disabled for one (legal for another) – user118923 Jul 29 '16 at 18:02
  • @user118923 : Please read en.wikipedia.org/wiki/Firewall_(computing) for background knowledge. In plain English, firewall is similar to a electronic door that required identity verification. It is easier to implement rules to STOP EVERYONE, but allow specific entry. You can do TCP port scan to "proof" this (port 1 to 65535) , however, some firewall may disconnect you when there is a rules to detect flood of port scanning . – mootmoot Aug 1 '16 at 8:16
  • The port is not an indication of the actual traffic (it is just a hint / tradition). One can have a VPN server set to listen on port 443 for instance. – WoJ Dec 18 '18 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.