Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 22 replies
  • Answers 1 answer
  • Subscribers 33 subscribers
  • Views 65537 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to block VPN apps?

The Do

Hi all,

I have a XG 550. I would like to block VPN apps like X-VPN, UltraVPN or something like that.
I created an application filter policy following this guide https://community.sophos.com/kb/en-us/123108

I also block all proxy and VPN app listed in Application Filter Criteria.

But user still can use X-VPN to bypass the XG.
My XG running 16.05.8.

Please give me some advice.
Thank you.



This thread was automatically locked due to age.
  • 0 in reply to Taher Ismail

    Hi guys, thank you for your all comments. Actually I opened a ticket support. There were at least 3 technical joined that ticket. Finally I received the best answer from the senior technical:

    - We expect user machine having Sophos Secure certificate available and installed on user machine as this is require HTTPS scanning needs to be enable in firewall rule which is there and without this setting XG will not take action on application traffic.

    For reference, please follow below KB article for adding certificate on user machine.

    https://community.sophos.com/kb/en-us/123048

    - Goto Protect > Web > Protection > Click on Advance and Enable below settings.

    > Enable Pharming Protection.
    > Block unrecognized SSL protocols.

    It could help. But we must installed the certificate on all devices joining the network. Is it possible? And somehow that settings also made some troubles with other apps like Facebook or Whatsapp.

    In general, it is impossible to block X-VPN in the simplest way by Blocking X-VPN category. And if you block X-VPN in any cost, some other apps will get issue.

  • 0 in reply to The Do

    Hey, so this method will basically look for anything sent in the headers. If there is anything in the headers to suggest it is a vpn it will be blocked. This method is essentially a man in the middle attack and will break most https sites if they have certificate pinning.

    If it helps, x-Vpn is partly written in go and some of the files it “steals” it’s code from are from GitHub.

  • 0 in reply to rfcat_vk

    This is a client and they are using they are using x-vpn to get past all of the other rules. What they don't know is that we are aware of what they are doing... :D

  • 0 in reply to The Do

    Are you aware of what other apps will have issues?  As this is a corporate client I have to be careful what I am blocking!

    They have VPN connections set up to access the server from 4 different locations and run a couple of different programs on it.

    Thanks kindly!

  • 0 in reply to Liz Gipson

    In my case, facebook can't load the image, whatsapp on mobile can't connect.

  • 0 in reply to The Do

    Sophos XG (SFOS 17.1.3 MR-3) is NOT blocking a number of VPN apps including X-VPN and Psiphon so our students are able to bypass all firewall rules and web filters. Enabling "Decrypt & Scan HTTPS" does not make any difference either. 

    I came across this post recently and unpleasantly surprised that 5 months later Sophos has not developed updated application filters rendering the Sophos XG firewall useless in a school environment. I have raised a support ticket with Sophos and will post feedback once I hear back from them. I manage a number of Sophos firewalls for schools and think it's time to consider other options. Fortigate is looking increasingly good!!!

  • 0 in reply to envercpt

    Thank you envercpt for your information. School environment is also exactly what i'm experiencing. Students always try to bypass the firewall. 

    I was creating a ticket support. The Sophos guy instructed me to do many many things and it looked block the X-VPN. But it also made difficult using other apps like whatsapp, facebook. 
    Anw, i'm looking forward from hearing the result from you. 

  • 0 in reply to The Do

    In a corporate environment errant employees can be fired. Difficult to fire students ;-)

  • 0 in reply to envercpt

    Sophos Support response to the ticket I raised: "The matter currently is being investigated by our development team with the ID NC-33664."

  • 0 in reply to envercpt

    Glad to hear that. Thank envercpt. Hope they can figure it out.