I help manage a small college campus network and students are not allowed to visit certain sites and download using torrents. Currently I'm able to block UDP VPN connections, but TCP VPN connections are a bit tricky. What are some methods to prevent users from using VPN connections to bypass these systems? Is there a service or software that can help with this? How does the China firewall do it?

  • Are you sure they are only using VPN? SSH Tunneling, Proxy, etc. are also solutions to enable unfiltered internet behind a Firewall. (SSH on Port 443 would like much like a normal HTTPS Traffic) – Serverfrog Mar 26 '19 at 14:06
  • @Serverfrog: "SSH on Port 443 would [look] much like a normal HTTPS Traffic" - not really. SSH and TLS (HTTPS) look totally different on the wire and one can see from the first bytes the difference. Of course, this would require to actually look at the payload and not just filter by port numbers. – Steffen Ullrich Mar 26 '19 at 14:17
  • @SteffenUllrich: You are right, but it should be possible to tunnel a SSH connection inside an HTTPS one. That way you have a correct HTTP protocol at high level, and the ssh is hiden in the encrypted HTTP bodies. AFAIK, only timings and sizes of packets in both directions could be a hint that the exchange is likely to be a tunnel.. – Serge Ballesta Mar 26 '19 at 15:11
  • @SergeBallesta: I agree that it will be much harder to distinguish. But "SSH tunneled over TLS looks mostly like HTTPS" is very different from "SSH looks mostly like HTTPS". – Steffen Ullrich Mar 26 '19 at 15:19
  • @SteffenUllrich: Of course! :-) – Serge Ballesta Mar 26 '19 at 15:28

It is the never ending race between weapons and armors... No firewall can prevent a user to do bad things. Stupidly simple firewalls (only port filtering) will mainly prevent unintentional misuse. Common firewalls (port filtering + HTTP(S) white/black lists will be enough for not too technical attackers.

If you want more, you will have to consistently analyze the logs to detect any anormal trafic, and then act accordingly by inspecting more and eventually asking the users for what they were actually doing.

What I mean here, if that the amount of work will grow by magnitude orders if you want to have the most secure firewall on earth. At a time, you will end in the good old cost/gain ratio...

And you should not forget the legal way. A firewall must exist to protect the internal network. By users should be warned that targetted attacks aimed at bypassing the firewall are strictly forbidden and could have legal consequences. A user that will use an unfiltered external HTTP proxy to bypass some HTTP rules can pretend it did it without really realizing what was happening. At least for the first time. But users that would setup a specific HTTPS tunnel to completely bypass the firewall would also have to fully assume their action. Technics is one hand, legal approach is the other one.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.