How To Block Psiphon/Ultrasurf

Hi,

there is a kba on how to block those and other similar products. The search function on this device is not very good so I can’t post a link.

ian

Hi,

there is a kba on how to block those and other similar products. The search function on this device is not very good so I can’t post a link.

ian

its really i Have XG 125 and ips search not good because proxy programs can work with 443 ports easily . That's Big Problem 

Hi,

you need to limit what ports are used, install ca on each device, enable web and application functions as well as ips.

Yoi will need to build your own policies for application and web to stop blocking your approved.

That is a start. Try those settings and see how far your get?

ian

I have already made these settings, and make denied rule for lan->Wan all ports except ( dns - http - https - smtp - imap - pop3 - ntp )
and nothing new 

app filter logs show thats denied psiphon, but its working fine at the client 

Please post a log entry showing the application access. Further, have you enabled decrypt and scan as well as scan http, FTP ?

ian

messageid="17051" log_type="Content Filtering" log_component="Application" log_subtype="Denied" fw_rule_id="6" user="---------------" user_group="----------" appfilter_policy_id="8" category="Proxy and Tunnel" app_name="Psiphon Proxy" app_risk="5" app_technology="Client Server" app_category="Proxy and Tunnel" src_ip="------------" src_country="R1" dst_ip="104.18.151.190" dst_country="USA" protocol="0" src_port="30476" dst_port="443" bytes_sent="0" bytes_received="0" status="" message="" appresolvedby="Proxy"

YES Enabled for all rules 

You logviewer entry shows it is blocked. So, if you use logviewer and refine search on the source PC IP which rules do you find passing the traffic?

The tunnels can be blocked successfully, my current setup blocks tunnels etc.

Ian

its only show blocked,,,, but psiphon works. 

psiphos uses unlogic category such as  ( Financial services - General Business - Information Technology )

i trace the one of hundreds destination IPs  is Translated to https://www.tradesuppliesfreedommedi.com/ its Financial Services category 

i'm really Sad for this problem  

Did you search the KBAs for advice on how tp block it?

Please post a copy of your application policy.

It can be stopped but requires quite tight firewall settings.

Ian