Block VPN Connection

am.steen

I am newbie and use pfBlockerNG which works for me good for site blocking, But when any one of my clients uses a VPN connection like hotspot shield for example he can access all
sites that I blocked before.

So is there is any way to block VPN Connection ??

johnpoz

@am-steen said in Block VPN Connection:

So is there is any way to block VPN Connection ??

Depends - do you know what fqdn they use to access? Do you know what port or IP they use.. If its to some random IP on port 443 for example - then it can prove difficult to stop users from doing this.

You need some way to identify the traffic is vpn, that you want to stop, and not something you want to allow.

Gertjan

@am-steen said in Block VPN Connection:

I am newbie and use pfBlockerNG which works for me good for site blocking, But when any one of my clients uses a VPN connection like hotspot shield for example he can access all
sites that I blocked before.
So is there is any way to block VPN Connection ??

The answer is in your question.

I'll do the clean up for you :

I am newbie and use pfBlockerNG which works for me good for site blocking,.....
So is there is any way to block .....Connection(s to sites) ??

Answer : use the feed that list the DNS's or IP's for these sites / connections.
The real question and answer is : is there a 'feed' that lists all the URLs or IPs that are used by all the VPN providers ?

Answer : Yes, as Netflix, just to name one, is using such a list ;)

I'm not sure if such list is really freely available.
edit : make one yourself ?

Maybe you should ask them.

Btw : port based blocking is useless, as VPN providers could use port 443.
And we all know that this port uses TLS .... and you can't look inside TLS so you won't know if it is a simple 'https' site or a VPN connection.
True, a VPN is most often UDP based .... A https site is TCP.

Basically, when you have people on your network that start to use VPN connections, you can start simplifying your 'pfSense' setup. As your 'users' can bypass everything.
Up until : stop sharing your connection - just use it for yourself.

Or contact one of the embassies of one of the countries listed on the above mentioned wiki page. Maybe they can help you ;)

am.steen

@johnpoz said in Block VPN Connection:

know what fqdn t
I do not know what fqdn they use to access ?
Is there anyway like pfBlockerNG Ready DNSBL Categories
to block all VPN connections ??

Tzvia

@am-steen said in Block VPN Connection:

I am newbie and use pfBlockerNG which works for me good for site blocking, But when any one of my clients uses a VPN connection like hotspot shield for example he can access all
sites that I blocked before.

So is there is any way to block VPN Connection ??

Adding to the replies above, about using PFBlocker- there is an ipv4 VPN feed, Ejrv_VPNv4, that you can start with, along with creating your own alias list of any you find they are using, then just block outgoing to those IPs/FQDNs. But a broader question (out of scope of all this hardware/software) is that you mention 'clients' which leads me to believe that these are people who hired you. Possibly businesses or individuals who hired you to set it up for them, as opposed to you trying to keep your kids 'in line'. Do you provide logs or other information to the business owner, assuming that the VPNs are a violation of the business policy? Yes out of scope of this forum, but part of the answer would come from the business, if the employees are violating policy. Not my place, just sayin...

am.steen

@tzvia said in Block VPN Connection:

ipv4 VPN feed, Ejrv_VPNv4

I am using pfBlockerNG-devel 3.0.0_15 but I can not find "Ejrv_VPNv4"
What is "ipv4 VPN feed, Ejrv_VPNv4" ??
Where to find it ??

johnpoz

Its right there on the feed page - scroll down a bit.. There a lots and lots of feeds to choose from..

Pulls the IPs from here
https://raw.githubusercontent.com/ejrv/VPNs/master/vpn-ipv4.txt

am.steen

@johnpoz said in Block VPN Connection:

https://raw.githubusercontent.com/ejrv/VPNs/master/vpn-ipv4.txt

I Found it but unfortunately last update is 23-3-2020 and it is not blocking any thing

johnpoz

@am-steen said in Block VPN Connection:

it is not blocking any thing

If used correctly it would block the IPs in the list.. But as stated - if your users are not using any of those IPs - then no it wouldn't block shit ;) heheh

You can not block what you don't know they are using.. They could be running a vpn server on some vps somewhere, just their home IP over 443 (just plain ssl like very other site on the internet).

Who says they are even using a vpn? They could be using just a simple proxy to circumvent filtering.

You need to know where they are going, what IP, what Port - if you want to block it..

edit: If you know they are using a specific service - hotspot for example. Look up the details of what IPs, ports, fqdn said service uses and block those., If you don't know what they are using - log all the traffic their IP is using... Look for the what is sus in their connections. Just looking at your state table for their IP, and what is the most used connection - could lead you to what they are using to block their vpn/proxy use.

If they are bouncing off your proxy - look in the proxy for where most/all their traffic is going - most likely thats the service they are using ;)

iraweaver

This post is deleted!

JKnott

@johnpoz said in Block VPN Connection:

If its to some random IP on port 443 for example - then it can prove difficult to stop users from doing this.

Many VPNs use UDP, so filtering on port 443 UDP shouldn't be difficult, as browsers would use TCP or QUIC.

jonatremoteeyes

@johnpoz unfortunately this no longer works @BBcan177 as the list is empty and not maintained. I found https://github.com/X4BNet/lists_vpn/blob/main/output/vpn/ipv4.txt which looks pretty good and is maintained - but it still istn' blocking XVPN which is what I'm trying to do ...

all help appreciated...

michmoor

@jonatremoteeyes

Have you simply tried reaching out to xvpn support and ask them for a either a list of IPs they use or a CIDR block they own?

https://xvpn.io/help-center/how-to-choose-the-right-vpn-server-location

###### If you have more specific needs, such as a server that is better suited for downloading content, please contact us or write to support@xvpn.io and we will provide you with a recommendation for a targeted solution.