Blocking Web Proxies and VPNs

You can use the Smoothwall Filter and Firewall to block access to HTTPS proxy sites or prevent HTTPS proxy software like UltraSurf bypassing the Smoothwall Filter.

Web filters are becoming increasingly popular, and are used to restrict a user's internet access to certain types of content. This has led to the creation of numerous proxy websites and proxy software applications designed to bypass web filters such as Guardian.

UltraSurf is one example of an application that bypasses web filters to gain access to sites that would otherwise be blocked. When someone uses a proxy website or application to request content, the proxy will contact a server which will then retrieve the requested content before returning it to the user, typically through an HTTPS connection. Because HTTPS traffic is encrypted, the content can't be seen by web filters and therefore no policies can be applied to the content. As more and more proxies are created on a daily basis, each becoming more complex and more efficient at bypassing web filters, simply blocking access to these services using domain or URL filtering alone is not particularly efficient.

Filter

1. Make sure that all clients are going through a transparent proxy with HTTPS support enabled, see our help topic, Creating authentication policies. Note: This might cause issues for other software applications which do not have support for this type of setup.
2. The Web proxies category is blocked by default as it is part of Core Blocked Content web filter policy, see our help topic, Managing web filter policies. You should add a block policy if you do not have one for either Web proxies or Core Blocked Content.
3. Create an HTTPS inspection policy that validate the certificate, see our help topic, Creating HTTPS inspection policies. This ensures that any site visited must present a valid HTTPS certificate.
4. As an alternative, you can create an HTTPS inspection policy to Decrypt and inspect HTTPS requests through the web filter. However, this requires that the certificate used by the Filter is installed on each of the client machines, see our help topic, Managing HTTPS inspection settings.

Firewall

Additionally, you can control access to ports using a firewall. If you are using the Smoothwall Firewall, you do this on the Firewall rules page, see our help topic, Adding new Smoothwall Firewall rules.

Proxies will typically attempt to connect to their servers on port 80 or 443. If this fails, then some applications have the ability to use other ports. The following details ports predominately used by proxy bypass software:

Blocking UltraSurf

UltraSurf is a proxy application installed locally on user's devices. Users then configure their browsers to point to the local proxy. The UltraSurf proxy sends outgoing traffic to HTTPS sites using IP addresses. This is still the case when UltraSurf sends out traffic directly to port 443 (HTTPS), or when UltraSurf is set to use an upstream proxy.

So, what can be done?

• Block the installation and execution of the UltraSurf application using domain-wide security policies
• Set proxy settings in a security policy so users cannot override them

These are basic recommendations when blocking UltraSurf traffic. Users may still get around security policies by using non-domain-managed devices, or those devices where the user themselves has administration rights.

Server Name Indication (SNI) adds to the HTTPS Transport Layer Security (TLS) handshake to indicate to the proxy which domain the traffic is destined for. SNI is used by the Guardian web filter when transparently intercepting HTTPS traffic.

Additional actions for the Guardian web filter:

• It is recommended you create a transparent web proxy authentication policy which blocks HTTPS traffic that does not present an SNI header. See our help topic, Creating authentication policies.
• Enable additional heuristics to block advanced proxy bypass tools. See our help topic, Configuring the web proxy.

Note: The two options, shown above, may also block legitimate applications from working if they use the same type of traffic as UltraSurf, such as, some cloud-based services. Without SNI information, Guardian is unable to easily differentiate between UltraSurf and non-UltraSurf traffic using any parameters other than destination IP addresses.