topic Re: Block websites when using VPN in General Topics

Block websites when using VPN

nredaj — Mon, 11 Mar 2019 06:02:59 GMT

Some users started to use SoftEther VPN client on our company which allows them to bypass URL Filtering policy. How can we allow them to use VPN client but still allow or block access to certain websites. We already implemented SSL decryption rule but it is not working when they are using SoftEther VPN.

Re: Block websites when using VPN

kiwi — Mon, 11 Mar 2019 09:08:39 GMT

Hi @nredaj ,

Is decryption working ?

How is the traffic identified by the firewall ?

Cheers,

-Kiwi.

Re: Block websites when using VPN

nredaj — Mon, 11 Mar 2019 09:56:30 GMT

Hi @kiwi ,

Decyption is working. Based on monitoring logs, when using VPN client, all traffic are identied as:

Application: SSL

IP Protocol: TCP

Port: 443

Category: computer-and-internet-info

Re: Block websites when using VPN

kiwi — Mon, 11 Mar 2019 10:11:49 GMT

Hi @nredaj ,

How is decryption working ?

If the application is identified as SSL then decryption isn't working.

Note that on some scenarios decryption is impossible ... for example when unsupported protocols or ciphers are used or with certificate pinning for example.

Cheers,

-Kiwi.

Re: Block websites when using VPN

nredaj — Mon, 11 Mar 2019 10:29:07 GMT

Hi @kiwi ,

It says decrypted. The problem is that users need to use SoftEther VPN to access certain website. But using this VPN client can bypass all our security rule in place. May be we can find another way to access the website without using VPN.

Thank you very much @kiwi

Re: Block websites when using VPN

kiwi — Mon, 11 Mar 2019 10:49:47 GMT

Hi @nredaj ,

You might be hitting this which could explain why a decrypted session is still showing up as SSL :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cle8CAC

Have you checked with support already ?

Cheers !

-Kiwi,

Re: Block websites when using VPN

Mick_Ball — Mon, 11 Mar 2019 16:16:59 GMT

Hmm, I think the ssl decryption here will not be as helpful as usual. you will only decrypt the outer wrapper (the actual tunnel) any ssl packets running through the tunnel will not be decrypted as negotiation for these will have taken place end to end via the tunnel, not the palo.

Re: Block websites when using VPN

BPry — Mon, 11 Mar 2019 18:23:29 GMT

@nredaj,

I would agree with @Mick_Ball in this case. Decrypting this traffic isn't going to give you much information and won't allow you to actually perform URL FIltering; this is actually the exact reason VPNs are recommended on untrusted networks, the network operator can't decrypt enough of the traffic to actually see anything useful.

Re: Block websites when using VPN

nredaj — Tue, 12 Mar 2019 07:56:27 GMT

I understand that this could be out of Palo Alto's FW scope.

This is a bit frustrating. Configuring static route in client side (windows OS) could have solve this issue but the website they're accessing is going thru CDN which cause IP address to change from time to time. Probable solution may be work out with SoftEther VPN configuration.

Thank you guys for all your inputs.