Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic?
In order to access SSL websites you need port 443 open but if you setup a VPN Service on port 443 you can dial out of the firewall.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes. Even if you run a VPN on port 443, HTTPS (which uses port 443) and VPNs have enough differences within the protocols that can be distinguished from the outside that a firewall or device that does deep packet inspection would be able to immediately classify both.
If your firewall does not block a VPN connection on port 443, it is likely that the firewall is only doing port filtering, or does not have protocol signatures for VPN connections yet.
It is possible to differentiate between "VPN traffic" and "standard SSL traffic", for an appropriate notion of "standard", of course. I suppose that by "standard", you mean people using a Web browser to access HTTPS Web sites.
The point is that while SSL is quite good at hiding data contents, it leaks data length: from observing the SSL records, one can work out the length of the cleartext contents (possibly down to single byte accuracy). A Web browser will issue HTTP requests, whose length is usually of a few hundred bytes, resulting in a corresponding (and bigger) response; and there will be pauses. Generic IP traffic encapsulated in a SSL-based VPN should exhibit a distinct pattern (in particular, the TCP three-way handshakes should be quite conspicuous).
While such tests will never be 100% reliable, they can be quite effective. Unless the users are fully aware of the presence and operation of such a detection mechanism, and try to defeat it. This can turn into an long-winded, tiresome war of detection and stealth. If your users are really keen on setting up a VPN, then this might be for some quite legitimate reason; it may be worth rethinking about why you want to block VPN but still allow "standard HTTPS".
If you can configure your VPN to first connect via TCP port 443 and then secure the comms under SSL (actually use TLS) and only then utilize the VPN protocol... then finally you would prevent the firewall from being able to detect that it is VPN traffic instead of HTTP traffic.
Stated another way, plaintext VPN traffic over 443 will look like VPN traffic, matching whatever protocol in use. SSL VPN traffic over 443 will look like SSL traffic.