HOW To Block Outgoing VPN Access ?

vfm_IT

I have a USG 110
I need to prevent the ability of visitors who connect laptops or Smartphones into the network and access the Internet via VPN client software. I can block regular web browsing through Content FIltering and App Patrol, but it does not block users who initiate VPN sessions from inside the network to access Unauthorized websites.

vfm_IT

Zyxel_Stanley
Thanks for your reply.
But must of the users who are bypassing my securities (APP control & Content filtering) with VPN Apps, are using smartphones.
And these users are eating the internet bandwidth by streaming or by downloading videos etc....
My next questions are the followings:
1- How do I identify the VPN app they are using on their smartphones from the USG?
2- How do I block the following VPN ports on the USG?
AH(51), ESP(50), IKE(500), NATT(4500), PPTP(1723), PPTP tunnel(47), OpenVPN(1194)

Zyxel_Stanley

Hi @vfm_IT  

In App Patrol function, there are some well-known VPN software are defined as “tunneling and proxy services” category.

You can block VPN software by this category.

Go to Configuration > Object > Application > And click “Add” button to create a APP Patrol object and add “tunneling and proxy services” as member.

Go to Configuration > UTM profile > APP Patrol > Click “Add” button to add a APP Patrol object. And select object which we added before.

Then Go to Configuration > Security policy > Policy control > Click Add button to block it by APP Patrol rule.

 

For blocking the VPN ports.

You can group the ports as an object, and block the traffic from LAN to WAN.

After these steps is able block almost VPN software traffic from LAN to WAN.

Zyxel_Stanley

Hi @vfm_IT

There are regular VPN ports, you can block them from LAN to WAN first:

AH(51), ESP(50), IKE(500), NATT(4500), PPTP(1723), PPTP tunnel(47), OpenVPN(1194)

But due to there are many different VPN software, so will use different protocols and port numbers.

You have to know which software is working on client PC first, and then block the traffic which initial from LAN to WAN.

vfm_IT

Zyxel_Stanley
Thanks for your reply.
But must of the users who are bypassing my securities (APP control & Content filtering) with VPN Apps, are using smartphones.
And these users are eating the internet bandwidth by streaming or by downloading videos etc....
My next questions are the followings:
1- How do I identify the VPN app they are using on their smartphones from the USG?
2- How do I block the following VPN ports on the USG?
AH(51), ESP(50), IKE(500), NATT(4500), PPTP(1723), PPTP tunnel(47), OpenVPN(1194)

Zyxel_Stanley

Hi @vfm_IT  

In App Patrol function, there are some well-known VPN software are defined as “tunneling and proxy services” category.

You can block VPN software by this category.

Go to Configuration > Object > Application > And click “Add” button to create a APP Patrol object and add “tunneling and proxy services” as member.

Go to Configuration > UTM profile > APP Patrol > Click “Add” button to add a APP Patrol object. And select object which we added before.

Then Go to Configuration > Security policy > Policy control > Click Add button to block it by APP Patrol rule.

 

For blocking the VPN ports.

You can group the ports as an object, and block the traffic from LAN to WAN.

After these steps is able block almost VPN software traffic from LAN to WAN.

vfm_IT

Zyxel_Stanley
Many thanks for your advise and support.