Technical Tip: How to block super unlimited proxy VPN

To block a super unlimited proxy.

Custom application signatures for unlimited proxy:

F-SBID( --name "Super.Unlimited.Proxy.Custom"; --app_cat 6; --weight 10; --protocol tcp; --service SSL; --pcre "/\x2E(superunlimited|mobilejump)\x2E/i"; --context host; --no_case; --tag

cset,cTag.Super.Unlimited.Proxy.Custom,300,src_ip,all_sessions; )

F-SBID( --name "Super.Unlimited.Proxy.TCP.Custom"; --app_cat 6; --weight 10; --protocol tcp; --dst_port 443; --pattern "|43 68 61 6e 67 65 4d 65 30|"; --context packet; --pattern !"|16 03|"; --context packet; --within 2,context; --pattern !"|17 03|"; --context packet; --within 2,context; --pattern !"HTTP"; --context packet; --no_case; --pattern !"SSH-"; --context packet; --no_case; --tag test,cTag.Super.Unlimited.Proxy.Custom; )

Create Custom Signature from CLI:

config application custom
    edit "Super.Unlimited.Proxy.Custom"
        set signature "F-SBID( --attack_id 1333; --name \"Super.Unlimited.Proxy.Custom\"; --app_cat 6; --weight 10; --protocol tcp; --service SSL; --pcre \"/\\x2E(superunlimited|mobilejump)\\x2E/i\"; --context host; --no_case; --tag cset,cTag.Super.Unlimited.Proxy.Custom,300,src_ip,all_sessions; )"
        set category 6
    next
    edit "Super.Unlimited.Proxy.TCP.Custom"
        set signature "F-SBID( --attack_id 4820; --name \"Super.Unlimited.Proxy.TCP.Custom\"; --app_cat 6; --weight 10; --protocol tcp; --dst_port 443; --pattern \"|43 68 61 6e 67 65 4d 65 30|\"; --context packet; --pattern !\"|16 03|\"; --context packet; --within 2,context; --pattern !\"|17 03|\"; --context packet; --within 2,context; --pattern !\"HTTP\"; --context packet; --no_case; --pattern !\"SSH-\"; --context packet; --no_case; --tag test,cTag.Super.Unlimited.Proxy.Custom; )"
        set category 6
    next
end

Follow the article below:

Technical Tip: How to apply and validate a custom application signature in FortiGate

Later, set the category 'Proxy' and the signatures, 'IKE' and 'ISAKMP', to block in application control; this should block most VPNs.

PPTP, L2TP signature falls under the proxy category, so it will cover VPN using those protocols. Ensure to use deep inspection in the firewall policy.

Follow the article below:

Technical Tip: How to block third party VPN

Note:
Fortinet's Technical Support department does not offer technical assistance in customizing application control signatures.

Use this form to submit a custom application signature request:

Application Control Submission Form

Details about what is and is not supported by Fortinet TAC support in support tickets can be found here:

Technical Tip: Technical support on customization on various Fortinet products