-2

hello to everyone,

i'm working in a big municipality and they told me to block some pages.. i used to setup Web proxy in mikrotik to redirect some pages to a specified destination ..

but, some users there have found some ways to use web proxy and still access these sites, or seems they are using "FREE vpn softwares" and access these sites,

my question is : HOW TO BLOCK all "VPN softwares"? is there any port that i can block? and is there a way to block all web proxy pages??

Thanks!!!

4
  • 3
    You are trying to solve a personnel problem using technological means. You need to solve this at an HR level by making clear what your expectations are to the employees. Short of implementing a deny all, whitelist-based filter, there's nothing you'll be able to do about this.
    – EEAA
    Apr 14, 2015 at 16:26
  • sir, i'm talking about how to block in mikrotik ALL users to connect any VPN and allow to access these pages???
    – h0feer
    Apr 14, 2015 at 16:33
  • 4
    Yes, and as I said, you'll need to block outbound access to everything for this to work, and then only whitelist specific sites you want your users to get access to. This is a policy and HR problem, not a technological problem. Your users will always find a way to get around whatever technological measures you put in place.
    – EEAA
    Apr 14, 2015 at 16:40
  • EEAA thanks for your comment, i just want to know how to PREVENT / BLOCK users to use vpn , that's all if u can help me please, becuase whitelist is not allowed in the rule they gave me to do ;/
    – h0feer
    Apr 14, 2015 at 20:42

2 Answers 2

0

You can block the following to deny popular VPN/Tunnel protocols.

Port 1701 UDP (L2TP)
Port 1723 TCP (PPTP)
Port 1194 TCP/UDP (OVPN)

Protocol GRE (7)
Protocol IP Encapsulation (4)

There is also SSTP but this usually works on port 443 so you cannot really block this port as it will block many websites as well.

0

All vpn software can connect over port 80 or 443 so blocking them is almost impossible.

You can only look to which IP addresses they go and block those in firewall rule &​ Firewall address

/ip firewall rule add chain=forward protocol=tcp dst-port=80, 443 action=dst-nat to-addresses=<internal IP address> action=drop dst-address-list=<Your Block List>

https://systemzone.net/how-to-block-vpn-access-with-mikrotik-router/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .