0

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store on my phone. Only apps that use IKEv2 work, OpenVPN and other protocols fail. One app specifically allows me to choose between OpenVPN TCP, OpenVPN UDP, and IKEv2. Both OpenVPN options are blocked, but IKEv2 works well.

Would it be possible for the router/firewall to be able to differentiate between encrypted IKEv2 and OpenVPN traffic, or is it just relying on port numbers to block/allow connections?

Some additional information:

  • The network is already known to perform MITM attacks. For instance, I have a website that I run which has HTTPS traffic encrypted by a Lets Encrypt certificate. When I visit this website via the network, I get a warning that the certificate is not trusted. The certificate details reported by my phone while using the network are different from those reported by my phone when I am not using the network.
  • I believe that the reason IKEv2 traffic is not blocked is that the network operators provide an optional VPN for use by devices on the network. I am guessing that said VPN uses IKEv2, and thus all IKEv2 traffic is unblocked (I don't know why all IKEv2 traffic is allowed, though).
  • By default/standard, IKEv2 uses UDP port 500 while OpenVPN uses TCP or UDP on port 1194. So they should be pretty easy to differentiate just based on that. – Patrick Mevzek Aug 7 '18 at 22:00
  • @PatrickMevzek What if I configure my OpenVPN server to listen on port 500 UDP? – vikarjramun Aug 7 '18 at 22:06
  • Like I said, "by default/standard". Of course if things are installed on other arbitrary ports then port-based filtering tool may not work. But DPI-based ones will still work, as both frames formats are different. – Patrick Mevzek Aug 7 '18 at 22:10
0

Yep, if you had something like a palo alto / fortinet behind the wifi network, it would be able to distinguish VPN types based on application signatures. Having a quick squizz at the ruleset for the openvpn app-id on my palo altos says you need port 1184 open as well as 443 and 80, so even if you were allowing access to IKE-V2 using a port-filtering firewall only,it still wouldn't work.

  • So it is still possible for them to block OpenVPN even if I have my server listen on IKEv2 port numbers? Is there any way for me to cloak OpenVPN traffic as IKEv2 traffic? Also, what do you mean by "Application Signatures"? – vikarjramun Aug 7 '18 at 22:06
  • Well, as OpenVPN and IKEv2 port numbers are different, then yes. But as to App-ids, If I built a rule using the palo alto open-vpn app id rather than just port filtering the firewall also checks for application signatures, known behaviours etc and classifies traffic according to that. There's a decent tech brief on the Palo Alto website at paloaltonetworks.com/resources/techbriefs/… – patchsurfer Aug 7 '18 at 22:38
  • It's not foolproof, by any means. There's more than one app-id that seems to be insufficient on its own and requires another (typically generic SSL) enabling. – patchsurfer Aug 7 '18 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.