I'm curious, have you had any more luck?
Standard security practice says that blacklists don't work for exactly the reasons you stated: they are a global game of whack-a-mole.
So what have you done to fix the VPN and private browsing issues that you reported two years ago?
On my network, we use a lightspeed with strict whitelisting. If it's not on the whitelist, no-one can get at it.... including IT. (super important, we apply the same rules to IT as everyone else. It's the easiest way to find out what does not work). When I instituted this way of doing things, my team got worried about the workload of creating the white list. However, a report on the most common URLs and which computers were accessing them gave us the majority of the white list. This worked for apps as well. Net result, any outgoing connection to anything we did not approve (all those lovely VPN apps, private home VPNs, secure browsers, TOR, etc...) was just dropped.
We did a fair amount of tweaking in the first year, but it quickly died down. Once the webzones became stable (they weren't always) teachers stopped worrying altogether.
Recently several people I work with at other schools purchased Smoothwall Appliances (one an S8 and the other an S14). They have not yet set them up, but I am very interested in how this will work out. The biggest issue seems to be getting the google authentication working properly...
So, your feedback and thoughts after two more years of use would be greatly appreciated.
