[Snort-users] RE: [Openvpn-users] Re: Anyone know how to detect OpenVPN traffic?

Michael Scheidell scheidell at ...5171...
Fri Nov 19 04:53:03 EST 2004

Security is a process.....
There may be no one good way to block or detect OpenVpn Traffic.
Best Practices should cut the problem down a bit.

Block all outgoing ports be default.
Only allow out what you have to, and only from those servers and workstations necessary.
Example: only allow port 25 out on mail servers, port 53 out on dns servers, udp port 123 on your ONE OR TWO internal time servers.

Workstations could be allowed out 80 and 443 (redirecting time and dns services internally) or sent to the corporate proxy server.

The above would block arbitrary outgoing ports.

An application inspection firewall like a CyberGuard would (I hope?) detect the non HTTPS type traffic on port 443 or none HTTP traffic on port 80 (Anyone with a CyberGuard care to comment?)

A packet shaping proxy server might be able to set bandwidth allocation to 0 if it didn't see valid http traffic.

Windows workstations can't run unless using Administrative privileges. Take that away from standard users!.

You might need 'nessus' or something to detect the OpenVpn 'service'.  In fact, a nessus plugin could be written to detect the win32 taps I suspect.

Try connecting to known openvpn port, watch the outbound 'heartbeat' traffic.

More information about the Snort-users mailing list