topic Blocking Hexa Protocol (Hexatech VPN) in General Topics

Blocking Hexa Protocol (Hexatech VPN)

brian.karleFCPS — Fri, 03 Jun 2016 16:06:50 GMT

I just became aware of this yesterday, but we were seeing a rise recently in "unknown-udp" traffic on our Palo Alto Firewalls and have discovered what it was. The amount of traffic was significant - always used the more bandwidth than anything else on the network. There is a new-ish VPN service by BetterNet that uses a protocol called "Hexa" (https://www.betternet.co/hexatech-vpn) and is free to install on Android and IOS devices. It tunnels 100% over UDP on randomized ports to over 2300 IP addresses that we've been able to isolate. It's designed specifically to be evasive and be difficult to block.

As I work for a large K-12 school district, we are obligated to take measures to ensure students are not using applications like this to circumvent web filtering. I have a case open with Palo Alto to see if an app-id is possible but in the meantime we've managed to stop this service from functioning by blocking any "unknown-udp" traffic.

If anyone else has run across this and has a better solution, I'm all ears.

Re: Blocking Hexa Protocol (Hexatech VPN)

Ashley_Bell — Mon, 21 Aug 2017 16:05:50 GMT

I see this is over a year old, but it's the only "betternet" result on the community. Did you have any luck? Or did anyone else on here find a way and I'm just not seeing it?

I too am in K-12 and have try my best to block this. I'm seeing it flagged on URL filtering, but it still works, unfortunately.

Re: Blocking Hexa Protocol (Hexatech VPN)

BPry — Mon, 21 Aug 2017 16:26:37 GMT

@Ashley_Bell,

Palo Alto actually has a App-ID for this; hexatech-vpn. I'm not sure how reliable it is but do you see that app-id within your logs at all?

Re: Blocking Hexa Protocol (Hexatech VPN)

Ashley_Bell — Mon, 21 Aug 2017 17:15:00 GMT

I do, trying it out now. I appreciate the quick response!

Looks like the app itself isn't blocked and content gets through - but the content is severely slowed, which if it makes it unusable, then good! 🙂

Re: Blocking Hexa Protocol (Hexatech VPN)

brian.karleFCPS — Mon, 21 Aug 2017 18:46:08 GMT

I was able to block it completely by blocking 'unknown-udp' and 'hexatech-vpn'.