Home page logo
/

basics logo Security Basics mailing list archives

RE: Blocking ssl vpn connections
From: "Brent P. Gardner" <brent.gardner () gmail com>
Date: Fri, 24 Mar 2006 16:52:31 -0700

OpenVPN cannot run as a monolithic executable.  It requires installation of a
software NIC.  This means it can't run from removable media such as CD-ROM or
USB drive.  Are we talking about Windows machines?  If you block driver
installation that will keep it off your machines.  The software NIC driver is
unsigned.  If you need driver installation you can set policy to reject unsigned
drivers.

I don't know how you'd block OpenVPN by watching the traffic.  OpenVPN defaults
to listening on UDP 1194 on the server side.  But of course that can be changed.
A strict egress filtering policy may catch it...


Brent Gardner


-----Original Message-----
From: Andrew Stewart [mailto:astewart () Gestampna com] 
Sent: Thursday, March 23, 2006 2:34 PM
To: security-basics () securityfocus com
Subject: Blocking ssl vpn connections


How would one go about blocking an SSL VPN (e.g. openVPN) on 
a firewall (or even detecting it via an IDS)?  I was 
wondering what a network/security administrator should do to 
prevent an employee from connecting to a SSL VPN from 
internal to the administrator's network to some unknown SSL 
VPN server.  I could see this being used for numerous things 
that are not in agreement with most companies acceptable use policies.

---------------------------
Andrew Stewart
Gestamp Alabama, Inc.
IT Support Tech

astewart () gestampna com

--------------------------------------------------------------
-------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting 
experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business 
Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
--------------------------------------------------------------
-------------



---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault