I can't block Psiphon VPN

Hi,

you need to install the XG CA on all devices, enable decrypt and scan, scan https. You will also need to tighten the allowed ports (not use any). This is a start and there is a KBA on the subject.

Ian

Hi Khaing Yin Mon,

Thank you for reaching out to Sophos Community.

Please refer to the below RR for better application detection(Recommended for Psiphon Proxy as well).

community.sophos.com/.../sophos-xg-firewall-cyberoam-application-filter-recommended-settings-for-better-application-detection

Thank for your help.

Hotspot is for public access bypassing voucher code. So I can't install CA. The following images are parts of this firewall rule.

Sincerely,

The problem with the document using ssl/tls scanning does not block udp which will used by the VPN. You will need to limit te ports otherwise the VPN will just go straight through, yes, I have experimented with blocking the VPN, so my answers are practical based.

ian