Block Proton VPN with smoothwall

[supportman]

Just had a incident in our school with students using the free proton VPN iphone app.

 

I had assumed smoothwall would have blocked this, but clearly not.

 

Just tested on my iPhone and it gets round all our filters. Any idea how to block? Seems it uses port 443 so cant do it that way.

[mavhc]

Their own iphone on a guest network I assume? Surely if you block it they'll just switch to cell network

 

Are you enforcing a proxy and tls inspection?

[BOOT]

Probably using QUIC. Block UDP ports 80 and 443.

[supportman]

Their own iphone on a guest network I assume? Surely if you block it they'll just switch to cell network

 

Are you enforcing a proxy and tls inspection?

 

Yep BYOD device, but it has no SIM card, just using our guest network with the proton VPN app.

Edited December 19, 2024 by supportman

[PaddyNewman]

Make sure guest network only allows the absolute bare minimum port wise, TCP 80/443 filtered, DNS only to your chosen provider or your local DNS (ideally one that doesn't support ECH) and NTP so they can get time. Maybe if you are nice, push notification ports, but I am not that nice.

 

If they get through that, its filtering.

[mavhc]

Basically don't have a connection to the internet at all, everything must go via a proxy, then if they try to use port 443 for non https it won't work. At which point they start to disguise traffic as https traffic

[supportman]

I've managed to block it by dropping packets to these 2 addresses which are the ranges for their dutch free servers.

 

[TABLE=width: 1774]

[TR]

[TD=class: wide-cell]Proton VPN IPs [/TD]

[TD]169.150.218.0/24

185.107.57.0/24[/TD]

[/TR]

[/TABLE]

 

Not a complete solution, but good enough for now.

 

EDIT: This is a good document on it as well

 

Smoothwall Filter & Firewall: Blocking Web Proxies and VPNs – Help Centre

Edited December 19, 2024 by supportman

[dapaulio]

Following