On 10/11/05, Jim Naslund <jnaslund at gmail dot com> wrote:
> Hi,
>
> I'm trying to block VPN access from my network because people are
> connecting to a nearby campus with VPN and downloading
> through direct connect that way. I made a firewall rule that rejected UDP
> packets destined for port 500 but this did not prevent access.
> The VPN connection I'm trying to block uses IPSec. Any suggestions?
>

depends on just how it does IPsec.  IPsec on many VPN devices can be
tunneled over any TCP port.  Also it uses the ESP protocol in many
cases, so block that.  I'd also block GRE to break PPTP, while you're
at it.

If the user has complete control over the remote VPN device, there is
no way to block access to it unless you know the destination IP and
can drop it off entirely (and hope they don't move to another dst IP).
 If the user has control of the device, they can do any number of
things to get around your blocking, like going through TCP/443 (HTTPS)
or TCP/80 (HTTP) which you likely can't block (unless you drop
everything outbound from users and force the use of a proxy).

In the end, this is a technical solution to a people problem, which is
rarely the best solution.

-Chris