2

I have some questions about squid proxies, we set a squid proxy server to block certain web sites for users. and some users only can access one website that related to our work.but after install some VPN software it can bypass squid proxy server. and access all web sites that blocked by squid how this happen ?

i don't have good knowledge about how squid proxy working and how VPN software tunneling through the squid proxy, I really want to know how those things happen.

  • I think this really depends on how Cyberghost is routing you, and at what point the server admins can see the traffic. – RoraΖ Aug 20 '14 at 13:37
  • At a minimum they'll see a brand new encrypted channel on their network. They might not be able to tell who is using it or what sites you're visiting, but the network traffic will be different. – RoraΖ Aug 20 '14 at 13:43
  • 3
    Just a heads up, often bypassing office policy (I.E. using a VPN without permission to bypass censors) is a terminable offence. Might want to be very careful. – Chris Murray Aug 20 '14 at 13:59
  • our network also firewalled using juniper netscreen 25 , it is possible to track me in firewall ? – sameera Aug 20 '14 at 15:05
  • @SemiraUthsala - YES! If I were your network admin you'd already have been escorted out of the building. That may yet happen to you next time they review the logs. – James Snell Aug 23 '14 at 9:37
2

1) Part of the answer depends a lot on the kind of company you work for. I used to work at a Fortune 100 defense contractor, and I can tell you any decent IT system will red flag unknown encrypted data leaving the company network in a heartbeat. They're not looking for someone accessing blocked sites, but that kind of activity can look a lot like a sophisticated attacker has compromised the company network and is stealing data. That kind of attention will get you terminated.

2) Most companies routinely install monitoring software on company devices. It's cheap, effective at keeping employees inline, and it's a great way to document 'cause for termination' when you want to fire someone. So, you should assume they can see everything on your screen, and log everything you type at any time. All they need is a reason to come looking.

In short, most companies will terminate you pretty fast for pulling something like this. It's not a matter of if you'll get caught, but when. So, you'd better be sure watching youtube (or whatever you're up to) is worth loosing your job over.

1

The VPN software most likely uses a CONNECT request which allows passing raw data through the proxy without interception - that's what's used to make HTTPS go through HTTP proxies without any TLS errors nor additional certificates.

In this case your sysadmin sees a connection to your VPN server (most likely on port 443 since most other ports are blocked by default because they aren't needed on an HTTP proxy) with a lot of data going through it; the proxy can't decrypt that data by itself but if you're using your company's PC there may be some monitoring software installed on it that allows them to look at what you're doing no matter what tunneling software you use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.