Technical Tip: Blocking Proton VPN

ajoy · ‎01-10-2023

Description

This article describes how to block Proton VPN by using a Custom application signature.

Scope

FortiGate 6.x. and 7.x.

Solution

Create a custom application signature as per below and set it to block:

1) Signature:

F-SBID( --protocol tcp; --service SSL; --pattern "protonvpn."; --context host; --no_case; --app_cat 6; --weight 10; )

2) Configuration Part:

# config application custom
edit "Proton.VPN.custom"
set signature "F-SBID( --name \"Proton.VPN.custom\";--protocol tcp; --service SSL; --seq 1,relative; --flow from_client; --pattern \"protonvpn.\"; --context host; --no_case; --app_cat 6; --weight 10; )"
next
end

This will create a signature and can be viewed in GUI.

3) Once this has been created it can be easily blocked by following this document:

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/233445/blocking-applications...