Blocking Hexa Protocol (Hexatech VPN)

[brian.karleFCPS]

I just became aware of this yesterday, but we were seeing a rise recently in "unknown-udp" traffic on our Palo Alto Firewalls and have discovered what it was.  The amount of traffic was significant - always used the more bandwidth than anything else on the network.  There is a new-ish VPN service by BetterNet that uses a protocol called "Hexa" (https://www.betternet.co/hexatech-vpn) and is free to install on Android and IOS devices.  It tunnels 100% over UDP on randomized ports to over 2300 IP addresses that we've been able to isolate.  It's designed specifically to be evasive and be difficult to block.

As I work for a large K-12 school district, we are obligated to take measures to ensure students are not using applications like this to circumvent web filtering.  I have a case open with Palo Alto to see if an app-id is possible but in the meantime we've managed to stop this service from functioning by blocking any "unknown-udp" traffic.

If anyone else has run across this and has a better solution, I'm all ears.

[Ashley_Bell]

I see this is over a year old, but it's the only "betternet" result on the community.  Did you have any luck?  Or did anyone else on here find a way and I'm just not seeing it?  

I too am in K-12 and have try my best to block this.  I'm seeing it flagged on URL filtering, but it still works, unfortunately.

[BPry]

@Ashley_Bell,

Palo Alto actually has a App-ID for this; hexatech-vpn. I'm not sure how reliable it is but do you see that app-id within your logs at all? 

[Ashley_Bell]

I do, trying it out now. I appreciate the quick response!

Looks like the app itself isn't blocked and content gets through - but the content is severely slowed, which if it makes it unusable, then good!  🙂

[brian.karleFCPS]

I was able to block it completely by blocking 'unknown-udp' and 'hexatech-vpn'.