I would like to stop people bypassing Opendns and squid proxy blocks to get on facebook using ssh tunnel to their pc home. I know I can fix this talking to boss but I'd also like to understand better how is technically possible.


You need to setup egress (outbound) filtering on your firewall for all TCP and UDP ports except where permitted by requirement (mail server, proxy server, DNS server, etc.).

  • Generally problematic if you need to let your users surf the web. – Shadok Jul 19 '11 at 14:39
  • 2
    @Shadok: that's what a proxy server is for. – gravyface Jul 19 '11 at 17:23
  • I was thinking about legit SSL traffic, what prevents users from setting up an ssl VPN on port 443 outside the office, from there even with SSL tunneling by web proxies (which are able to check the certificate) I think you can't block anyone from bypassing the rules in place. The only thing I see is QoS to enforce this rule without disrupting legit, common web traffic. – Shadok Jul 20 '11 at 10:10

If you have users that are capable of creating ssh tunnels to their home equipment then you are not going to be able to do this using technology unless you can take away the tools that allow them to do this. All you can do is enter into an arms race with them.

You will have to get your management involved - it really is their issue to deal with.

  • Yup, policy first, then enforcement (which could be simply logging the circumvention activity to a syslog server). – gravyface Jul 19 '11 at 12:53
  • I do understand the suggestion and I've already said in the question that the key of the problem would be just speak about it with the boss. That's an adrministration and not a technical problem... But I was just curious about any tool to control it on the technical side. – Pitto Jul 19 '11 at 15:54
  • @Pitto: If they have the tools and the know how - you can't stop them. You have to take the tools off them and ensure they can't get them again. – Iain Jul 19 '11 at 15:58

Basicly, you can't fix this. When there 's an open port, people can create tunnels. I myself use OpenVPN via tcp 443, because that's always open. Alternatives are via other protocols, like icmp or dns.

With clever enough users, you cannot block parts of the internet. (Ok, maybe China can ;)) If you don't want workers to go online, block webbrowsing. If they need it for their job, you have to live with the fact that they can get onto facebook. Last resort is creating penalties for everyone who does go to facebook, but I personally wouldn't want to work at a company like that...

  • In China they use tor I think :) – Pitto Jul 19 '11 at 15:54

Gravyface is right.

Otherwise, maybe DPI (Deep Packet Inspection) could have a pattern to identify tunnels from other SSH traffic but those appliance are costly.

Maybe you could use the TOS (Type of Service) to identify bulk SSH from interactive SSH and apply some bad QoS rules. The down side is that you would impact scp/sftp sessions too.

  • Interactive SSH TOS = 0x10 (16 decimal);
  • Bulk SSH (e.g. SCP, SFTP) TOS = 0x08 (8 decimal).

Tunnels should fall in bulk.


This is more of a policy issue than a technical one. You correctly point out an obvious method for users to bypass any restrictions you may place on the network technically.

Some percentage of users will not be able to figure out the tunnel approach and those should be easier to contain with DNS blacklists or equivalent. The technical users who would bypass your restrictions need to be dealt with in a different method.

Consider why you need to block this traffic before you travel too far down this road.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.