Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company runs filters on contents available for browsing and I have to check if everyone is respecting the browsing policies. Recently I have spotted some users activate OpenVPN on their workstations and i have discovered that they connect on port 443 of an external server and then use a proxy to circumvent the company filters. Is there any method to monitor VPN connections on allowed ports or to avoid the connections?

share|improve this question
However, how do you distinguish HTTPS traffic to a site (e.g. mybank.example ) from HTTPS traffic to a proxy ( e.g. -> time.waster.example/games )? Both requests will be correct, valid HTTPS... – Piskvor Jun 16 '10 at 8:34

Do we take it that this OpenVPN connection is not set up by you/your company, and that the end users are connecting to their own OpenVPN server? If OpenVPN is using the standard ports you can certainly block them: drop or reject traffic to TCP and UDP ports 1194, perhaps from specific machines (the users in question) and to specific machines (the OpenVPN server). As it's not (sorry for missing that first time) your question then becomes "How can I distinguish between legitimate HTTP-over-SSL-on-TCP-443 and disallowed OpenVPN-over-SSL-on-TCP-443?". A tool like ssldump might reveal some difference between HTTPS and OpenVPN but turning that into a firewall rule to reject traffic to a particular server might be difficult.

OpenVPN uses SSL for encryption, and breaking that is non-trivial, so you cannot see what's in the VPN traffic from the firewall or other 'gateway' host, however a decent packet sniffer (wireshark) will at least tell you there is SSL traffic between workstation A and public internet address B. You could install traffic sniffers on user's desktops (again you've not said what platform, but I'll assume Windows) directly, and sniff the 'tap' device (there are privacy considerations, especially if people are allowed to use VPNs for light personal use).

Arguably this is as much a policy violation/personnel problem as much as a technical issue, so getting bosses/human resources people involved wont be a bad idea, i.e. get them to announce/reiterate the policy and indeed that technical measures will be taken to reinforce this policy. Do check first that the users are genuinely using OpenVPN to bypass content filtering and what they're accessing - i.e. if they're doing it to access work-related stuff then you should consider whether your filtering policy is of genuine benefit to the company, or it's simply an impediment to getting work done such that people are having to expend time and effort to work around it.

share|improve this answer
As i said, the unauthorized vpn connections are made on allowed ports that i cannot close (443 - https) and not on standard openvpn ports (1194). The question is if a sniffer (like Wireshark) can distinguish from allowed traffic (like a secure webpage) a VPN connection on the same port. I'm not discussing ethic or moral questions: my company tells me to do so and I do it. – Federico Fenara Jun 10 '10 at 9:35
@Fen0x: it is possible to recognize some types of trafic by using "deep packet inspection" techniques, although the detection probably won't be fully 100% accurate. Whether this is legal or not ... it may be or not, that depends on many things - but that's a question for your company's legal dept, not for SF :) – Piskvor Jun 10 '10 at 9:41
@Piskvor: Wireshark is capable of deep packet inspection? Is it possible to have an automatic warning for monitored ports? I agree with with you for the legal issues, in Italy there's a plenty of privacy laws but I'm a technician not a lawyer. The only thing I'm sure is that I cannot install a sniffer on every workstation of my company site (5000+ PCs). – Federico Fenara Jun 10 '10 at 9:47
@Fen0x - Wireshark will try and dissect each packet as well as it can; it's an interactive tool however and isn't practical for such large-scale analysis. Not sure what tools to use for automatical inspection of all data, sorry. – Piskvor Jun 10 '10 at 10:55
@Piskvor: don't worry, I have my "iron pants" on. I have documents stating that the company is assuming his responsabilities on my work. I wanna specify that I don't have to inspect the content of all the connections but simply identify which VPN connections are made on an open port. So I think there should be no violation of the personal privacy of the employees. – Federico Fenara Jun 10 '10 at 11:43

This seems like a personnel issue, and not a technical one. Your organization should be performing regular security audits of your workstations. It should be made clear that if any user is caught using unauthorized software including VPN, proxies, etc, they will be sanctioned.

Really, there's not an 'easy' way to tell the difference between HTTPS over port 443 and OpenVPN. It's doable, but requires more effort than it's worth. If you see an extraordinary amount of traffic, or something else tips you off, maybe it's best to have an 'education session' with your users.

share|improve this answer
you're right. I've already mailed a copy of the security policies stating that is prohibited to use unauthorized VPN connections to all the company mailboxes. The problem is that we have also a lot of external consultants, using their own laptops on our network, that you cannot check for VPN software. I tried to get some statistics on the amunt of traffic on the allowed ports but it's not easy to tell if someone is making "legal" traffic or not. And I must be sure before telling someone that he's violating company policies. – Federico Fenara Jun 10 '10 at 15:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.