topic Re: Student extensive use of VPNs. in Advanced Threat Prevention Discussions

Student extensive use of VPNs.

JCMoritz — Tue, 13 Dec 2022 17:56:51 GMT

Hello Livecommunity. We are in a bind. We have numerous students on our school networks that are bypassing security profile rules with VPNs. So frustrating. I do have rulesets that look for annnomizers and proxies. I also have explicit rules that look for categories such as Facebook, Snapchat, etc... Not sure what to do. I worry that the more rules I setup in the firewall, the more work it has to do and gets sluggish? Am I right? I did see something about disabling 'QUIC" which I can but want this firewall to be optimized and working very well.

Any suggestions (even mean ones) appreciated.

Best,

Jean-Claude

Re: Student extensive use of VPNs.

Raido_Rattameister — Tue, 13 Dec 2022 18:06:20 GMT

Firewall don't see into QUIC traffic so it is best practice to block it.

Block URL category proxy-avoidance-and-anonymizers

In addition create application filter for subcategory "encrypted-tunnel" (Objects > Application Filters) and block it for students.

Place this block rule after you have permitted outgoing SSL application.

Re: Student extensive use of VPNs.

JCMoritz — Tue, 13 Dec 2022 18:13:51 GMT

Thanks @Radio_Rattameister, will try tonight.

Re: Student extensive use of VPNs.

StephenPrevost — Tue, 21 Nov 2023 21:23:03 GMT

I hope you found a solution to the problem.

Re: Student extensive use of VPNs.

Major2375 — Wed, 22 Nov 2023 16:49:42 GMT

Hi,

so if the users are applying VPN's why dont you create a rule for lets say 'zone class B' that is not allow to do traffic the traffic that you saw?
do the rule based on layer 4 tcp/udp port number