I help manage a small college campus network and students are not allowed to visit certain sites and download using torrents. Currently I'm able to block UDP VPN connections, but TCP VPN connections are a bit tricky. What are some methods to prevent users from using VPN connections to bypass these systems? Is there a service or software that can help with this? How does the China firewall do it?
It is the never ending race between weapons and armors... No firewall can prevent a user to do bad things. Stupidly simple firewalls (only port filtering) will mainly prevent unintentional misuse. Common firewalls (port filtering + HTTP(S) white/black lists will be enough for not too technical attackers.
If you want more, you will have to consistently analyze the logs to detect any anormal trafic, and then act accordingly by inspecting more and eventually asking the users for what they were actually doing.
What I mean here, if that the amount of work will grow by magnitude orders if you want to have the most secure firewall on earth. At a time, you will end in the good old cost/gain ratio...
And you should not forget the legal way. A firewall must exist to protect the internal network. By users should be warned that targetted attacks aimed at bypassing the firewall are strictly forbidden and could have legal consequences. A user that will use an unfiltered external HTTP proxy to bypass some HTTP rules can pretend it did it without really realizing what was happening. At least for the first time. But users that would setup a specific HTTPS tunnel to completely bypass the firewall would also have to fully assume their action. Technics is one hand, legal approach is the other one.