Skip to main content
Jasonhilt
Jasonhilt
New Member
December 14, 2016
Question

Betternet VPN

  • December 14, 2016
  • 3 replies
  • 21200 views

Was recently notified that students are able to use the Betternet VPN app on their phones over our wireless to bypass the webfilter.  I have checked analyzer logs and it does block the website but not the IPs that the app is connecting to.

I have checked the school computers and everything seems to be blocked and the Chrome extension doesn't work.

 

Anyone know how to block this when it's used on a non-school owned device/personal device?  I have tried blocking individual IPs with some success, but not 100%.  Only issue is I don't know what other websites will be blocked in the process.

 

We have a Fortigate 1240B running v5.2.5 build 701

 

    3 replies

    SCSIraidGURU
    SCSIraidGURU
    New Member
    December 14, 2016

    Did you block it under application control Proxy?  Look at blocking PPTP VPNs. 

    Jasonhilt
    JasonhiltAuthor
    New Member
    December 14, 2016

    So I setup a policy just for my iPhone to test with.

    All application categories are blocked - vpn still connects.

    All FortiGuard Categories are blocked - vpn still connects.

    Individual IPs that I THINK might have something to do with the vpn are blocked - vpn still connects.

     

    I am at a loss how it's getting through.

     

    edit:

    I have tried Proxy, Flow-based and DNS on the Web Filter policy with no change.

     

    SCSIraidGURU
    SCSIraidGURU
    New Member
    December 14, 2016

    Did you add it to Application Signatures as a block rule?  Betternet.vpn block also is all of Proxy listed as block?   What is your application control rule in the wireless policy set to default?   Can you create a custom policy? 

    SCSIraidGURU
    SCSIraidGURU
    New Member
    December 14, 2016

    Can you find the traffic in the logs getting though?  What does it say about the destination? 

    Jasonhilt
    JasonhiltAuthor
    New Member
    December 15, 2016

    So I figured out how it was getting past the firewall.  There was a policy that was implemented, not by me of course, that opened up the WiFi Calling service to and from the whole network.  It was set as the first policy and all the student policies are much lower on the list and lower on the page.  I didn't see it until I started moving my test policy up towards the top.

     

    So for future reference to anyone else having this issue:  WiFi Calling service will/can allow VPNs to bypass any other restrictions you have set.

    SCSIraidGURU
    SCSIraidGURU
    New Member
    December 15, 2016

    35 years of dealing with firewalls and Cisco routers taught me a great rule.

    1.) Deny before Allow!

     

    CISCO ACLs and firewalls work in rule order.  So place your deny rules first.  Place your allow rules after.  I want to block something, top of policy or ACL lists.  I want to put in a partial allow and then deny everything.  Put the partial allow ahead of the complete deny rule.  With Fortinet you need outbound rules for traffic to get out to the internet.  They go at the bottom of the policy list by interface.  SSL-VPN and Wifi below them.  Any deny rules above all these.  

     

     

    SCSIraidGURU
    SCSIraidGURU
    New Member
    December 16, 2016

    Security Profiles Application Control

    You will see Proxy Under that is Betternet.VPN. You can make an Application Override and add it to the block.

     

    You can get all the IP addresses for Betternet.vpn and build a custom policy to block the traffic to this.  You might also look at PPTP VPN policy and block that.  You place these at the top of the list.   You need these outbound from your users to them. 

    Terms & ConditionsAccessibility statement