So I am at a coffee shop and trying to connect to my VPN (the VPN is configured just fine) but the service seems to be disabled by the coffee shop's network. How can a coffee shop block VPN connections? Are they blocking a list of known VPN IPs or are they blocking the protocol altogether?
It can be either. Technically speaking one can block
- a remote IP
- a remote port
- a specific pattern of traffic
Even though VPN connections are encrypted and if you choose a non-descriptive IP and port, someone can still rely on the traffic pattern. This is not foolproof and heavily depends on the protocol but for instance OpenVPN is blockable this way (the way it initializes its connection (the "handshake") is specific).
The pattern filtering is available on higher-end equipment so I would guess that the filtering will be on the port. The blacklist is not simple to maintain so it is less likely.
It can also be that only some ports are allowed (HTTP and HTTPS usually) so anything else (including your VPN) is rejected.
It is obvious firewalling practice : Block everything, only open port you want.
Just open http(80) and https (443) is enough to server most of the internet traffics.