topic Re: Psiphon blocking in a non-decrypted network in General Topics

Psiphon blocking in a non-decrypted network

MRamadanAHafiez — Sat, 25 Sep 2021 14:06:27 GMT

Hello Bros'

Recently, I have issues with the application called Psiphon, this app is eating my internet based on authentication portal page.

As I check previous threads in the community, all speaking about a decrypted traffic or blocking an applications that are vital such as http-proxy
,ike, ipsec, l2tp, ssh, ssh-tunnel.

it a virtual wire deployment and traffic decryption can't be done due to network needs.

Any one who could succeed in this Psiphon blocking because simply blocking the application in a security rule is not working unless traffic being decrypted.

Any recommendation, Thanx in advance.

Re: Psiphon blocking in a non-decrypted network

BPry — Sun, 26 Sep 2021 03:16:39 GMT

@MRamadanAHafiez,

If you can't enable decryption and you can't block the associated app-ids that the traffic relies on, the next possible step would be blocking the domains or hosts that Psiphon relies on. Due to how Psiphon works and how it connects, you can't really successfully block it without Decryption enabled.

If this is something you simply can't enable on your network I would start blocking clients you've identified as running this traffic. Assuming you have rules against bypassing your firewall, simply block anyone you've identified as bypassing the firewall.

Re: Psiphon blocking in a non-decrypted network

LAS — Tue, 28 Sep 2021 08:04:10 GMT

i had that same issue but with users personal mobile phones, i made a dynamic group and auto tagged and blocked the users that used psiphone.

as you will see that psiphone tries to connect with ssh as well and changes the sites SNI field to random sites to hide the URL traffic

Re: Psiphon blocking in a non-decrypted network

MRamadanAHafiez — Sat, 09 Oct 2021 19:39:34 GMT

Thank for you add LAS.

I have exactly same issue with mobile phone but the psiohon changes alot, hence blocking it won't work.