Block XVPN servers

Hi,

you can use application policies and web policies. You can also create an FQDN for xvpn.io, create rule at the top of your rule list that blocks/drops connections to the FQDN.

Ian

Hi,

you can use application policies and web policies. You can also create an FQDN for xvpn.io, create rule at the top of your rule list that blocks/drops connections to the FQDN.

Ian

Thank you for your reply. But we also have this option applied and it does not work.

I found a combination of blocking zwfgygpztq.com and using the SSL/TLS profile of "Block Insecure SSL" did the trick. Blocking the first site I believe makes the X-VPN client fall back to using spoofed certificates from sites like Google, Amazon, Facebook which that Profile will block. The client will either not connect or connects but can't pass any data.

Regards

XG says can't resolve  zwfgygpztq.com in FQDN host. Does it matter? Thanks.

I put it in a URL list and blocked it at the web policy level. It's possible that host could have changed (it has been a while) but the Block Unsecure SSL policy should work regardless.

Good morning. So far none of the methods are working, is there any way to prevent the computers from having to install the firewall certificate? So far we have never implemented it, besides it would be an inconvenience at the end customer. Thank you very much

It is a nightmare getting the decryption certificate out there, the XG could really do with it in the user portal (like the old SG UTM had) so users can sort themselves out.

Do you have any other firewall rules outbound to ANY? things like DNS and NTP are exploited as a way for these types of clients to get out. As a matter of course we always restrict these types of rules, there's nothing like seeing 5gb of DNS over a couple of days to tell you there's a problem.

You can also look at the log files while starting the XVPN client and see what it does and block accordingly.

You will need at least two entries in the fqdn table, x vpn.io and x-vpn.io in the firewall rule at the top. It will not stop access to download the software but will block it from running.

ian

Hello. As I said before, they introduce the proxy servers in the configuration of the iPads. The problem is that they don't have restricted access to the configuration. So, we are trying to safeguard that problem. Regards