1

I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or securitykiss.

I spend some time to found that most of these technologies use port 80 and 443 which is used by most sites and if I blocked them the whole internet is blocked.

one solution that I found but I can't dare to apply is using sophos home network firewall, however this technology need a whole separate dedicated computer to control the network.

So my question is, is there is any software with password or a way on the router to block vpn connection on the whole network and not just one device?

  • You are going to have to route all traffic through the machine in order to allow the machine to inspect the traffic and block it, so a dedicated firewall sounds like the best option as you'll be doing Deep Packet Inspection to find out if the traffic on 443 is legit HTTPS or VPN traffic. If you're going to route all your traffic through your own working-machine: 1. Whenever your machine is down, the entire network loses internet access, 2. If your machine gets infected, the perpetrator can access all data that goes through the gateway. 3. Network speed will be limited to your Adapter speed. – Nomad Aug 29 '18 at 12:37
4

This is a classical mistake: solving a policy problem with technology.

Your case is exact the same as every systems administrator trying to protect his corporate network from users using VPN and tunnels to avoid the corporate proxy. No matter how many tools and techniques you implement, there's always one obscure way to avoid the locks.

The foolproof solution is policy. You (and the sysadmin) must create and enforce a rule stating that VPN use is forbidden, users caught will be punished, and what is the punishment. In your case, losing physical access to a cellphone/tablet/console is enough.

  • I like your sincerity and your experience. However, its for home protection for my kids! There should be some one concerned who did thought about it! but thank you very much I liked your answer – Omar113 Aug 29 '18 at 16:26
  • 2
    Your kids have way more time than you, more incentive to bypass the locks, and they have to succeed only once, but your lock must succeed every single time. You could hire a banker's sysadmin to secure your home network, and it would not remain secure forever. Your kids will break the lock and you will not notice unless your second job is monitoring your own network. I would configure OpenDNS, sit them all to talk, lay down the rules, and enforce the rules. They will hate the rules, but I don't know any kid that likes to take vaccines either. – ThoriumBR Aug 29 '18 at 16:40
  • 1
    When I was in college, one our our hobbies was to find ways to circumvent the enterprise and expensive web filters, professionally supported by experienced staff. Result: we had a long list of ways to bypass the filters. Some guys got caught, got a lecture on security, suspended for a couple days, but the majority of us could access anything we wanted, without ringing the bells on the desk of the staff. If you rely on technology, your kids will do the same. Worse: they will go to dangerous sites (malware-wise) after knowledge and be more at risk than if they don't even try to break the rules. – ThoriumBR Aug 29 '18 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.