NordVPN being blocked with 'Flow-based' Policy but allowed with 'Proxy-based' Policy

Question

Hi,

Can somebody please shed any light on this for me. I have configured Application Control to 'Block' the 'Proxy' category and I have 'Deep SSL Inspection' enabled on my firewall policy. When the firewall policy is set to 'Flow-mode' the NordVPN client on the PC is blocked, however when the exact same policy is set to 'Proxy-mode' NordVPN can connect successfully. I can see logged Security Events for Wireguard being blocked when in 'Proxy-mode' but eventually the NordVPN client passes through the UTM and connects. Can somebody please explain why this is the case? I thought 'Proxy-mode' was a more thorough inspection and would expect to see the opposite behaviour.

Interestingly just to add to this, I see a lot more granularity in the Applications listed in the Security Event logs when using 'Flow-based' opposed to 'Proxy-based' inspection.

Regards,

Jonathan.

quintinmorrow · Answer

That behavior actually makes sense once you look at how flow vs proxy inspection works under the hood. Flow-based tends to rely more on signatures and can miss or block things differently compared to proxy mode with deeper inspection. I’ve seen VPN apps behave inconsistently between the two as well. Tweaking profiles or checking **application control tuning** usually ends up being the key to getting consistent results across policies.

Sign up

Login with SSO

Login to the community

Login with SSO