Betternet VPN

[Jasonhilt]

Was recently notified that students are able to use the Betternet VPN app on their phones over our wireless to bypass the webfilter.  I have checked analyzer logs and it does block the website but not the IPs that the app is connecting to.

I have checked the school computers and everything seems to be blocked and the Chrome extension doesn't work.

Anyone know how to block this when it's used on a non-school owned device/personal device?  I have tried blocking individual IPs with some success, but not 100%.  Only issue is I don't know what other websites will be blocked in the process.

We have a Fortigate 1240B running v5.2.5 build 701

[SCSIraidGURU]

Did you block it under application control Proxy?  Look at blocking PPTP VPNs. 

[Jasonhilt]

So I setup a policy just for my iPhone to test with.

All application categories are blocked - vpn still connects.

All FortiGuard Categories are blocked - vpn still connects.

Individual IPs that I THINK might have something to do with the vpn are blocked - vpn still connects.

I am at a loss how it's getting through.

edit:

I have tried Proxy, Flow-based and DNS on the Web Filter policy with no change.

[SCSIraidGURU]

Did you add it to Application Signatures as a block rule?  Betternet.vpn block also is all of Proxy listed as block?   What is your application control rule in the wireless policy set to default?   Can you create a custom policy? 

[SCSIraidGURU]

Can you find the traffic in the logs getting though?  What does it say about the destination? 

[Jasonhilt]

So I figured out how it was getting past the firewall.  There was a policy that was implemented, not by me of course, that opened up the WiFi Calling service to and from the whole network.  It was set as the first policy and all the student policies are much lower on the list and lower on the page.  I didn't see it until I started moving my test policy up towards the top.

So for future reference to anyone else having this issue:  WiFi Calling service will/can allow VPNs to bypass any other restrictions you have set.

[SCSIraidGURU]

35 years of dealing with firewalls and Cisco routers taught me a great rule.

1.) Deny before Allow!

CISCO ACLs and firewalls work in rule order.  So place your deny rules first.  Place your allow rules after.  I want to block something, top of policy or ACL lists.  I want to put in a partial allow and then deny everything.  Put the partial allow ahead of the complete deny rule.  With Fortinet you need outbound rules for traffic to get out to the internet.  They go at the bottom of the policy list by interface.  SSL-VPN and Wifi below them.  Any deny rules above all these.  

[ABell]

I'd like to try this.  What specific service am I looking for?

[SCSIraidGURU]

Security Profiles Application Control

You will see Proxy Under that is Betternet.VPN. You can make an Application Override and add it to the block.

You can get all the IP addresses for Betternet.vpn and build a custom policy to block the traffic to this.  You might also look at PPTP VPN policy and block that.  You place these at the top of the list.   You need these outbound from your users to them.