Results 1 to 3 of 3
  1. #1
    Untangler
    Join Date
    Aug 2009
    Posts
    46

    Default TurboVPN Problem

    As is typical in a K-12 school, students will try to use VPN apps on their phones to bypass Untangle. For the most part the Application Control and Web Filter rules have stopped them. However, TurboVPN is somehow connecting, no matter if I choose "Block" or "Tarpit" in the Application control list. I tried it with my phone in order to analyze the traffic in the Application Control reports, please see attached.

    Notice that there is a blocked event, however the events above are when the app does connect. There are also multiple block attempts during this time in the firewall for outbound to India (I block traffic to several countries).

    So obviously the question is, how in the world is this app connecting?
    Attached Images Attached Images

  2. #2
    Untangler
    Join Date
    Aug 2009
    Posts
    46

    Default

    UPDATE:

    This is why I LOVE Untangle! Oh the reporting makes this research so effective!

    I was able to stop the TurboVPN app by tarpitting the additional applications: NNTP and Telnet

    In addition, I added an inspect rule in SSL Inspector for any traffic with *turbovpn.co in the SNI Host Name.

  3. #3
    Untangler jcoffin's Avatar
    Join Date
    Aug 2008
    Location
    Sunnyvale, CA
    Posts
    7,846

    Default

    If you don't have it set to tarpit, I suggest using tarpit instead of blocked as many of the tunneling apps will try different IPs, ports, protocols if it gets a session reset.
    Attention: Support and help on the Untangle Forums is provided by
    volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2