Seeing your VPN by the company

[Urukod]

When before connecting your phone and start using internet on it at the office of a company if your are one of their employees, there’s always some kind of internet usage policy. And some time, you have to install a certificate for “protecting their WiFI”. In the internet usage policy, there is always a paragraph that says “you can’t install and start using any form of bypass WiFi security protection such as VPN” or something like that.

 

 

Unless blocking each VPNs servers one by one, is there a effective manner to the company that they can see your using a VPN and blocking your device / some form of penalties?

[Skipple]

Just now, Urukod said:

In the internet usage policy, there is always a paragraph that says “you can’t install and start using any form of bypass WiFi security protection such as VPN” or something like that.

Internet usage policies are more of legal protection than anything else.

 

In-terms of actually enforcing that, I'm sure there are services such as Proofpoint or Palo Alto that would keep a running log of VPN service IP addresses and block traffic to those. Most of this stuff is outsourced. 

[RMerlin]

DPI can detect various types of VPNs.  Just look at what China is doing on their end to prevent VPN usage.

 

It's not 100% foolproof (as one using technologies like Shadowsocks, or OpenVPN + the obfuscate patch + TLS encryption of both data and control channels can be very difficult to identify), but detection rate can be pretty high without having to know all the popular ASNs from VPN providers (which can be worked around anyway by running your own VPN in a VPS or even at home).

 

That ease of detection means you are quite likely to get caught, and then be summoned into the HR's office...

 

 

[Urukod]

So it the same thing for all VPN technology, including IPSec, OpenVPN and WireGuard?

[RMerlin]

On 8/11/2020 at 12:53 PM, Urukod said:

So it the same thing for all VPN technology, including IPSec, OpenVPN and WireGuard?

Some are easier to block (like IPSEC) others are harder (like Shadowsocks), and others will depend on how you set them up (OpenVPN).

 

I'm not sure how easy it is to detect Wireguard.  Right now it's very new, so I assume very few networks would be secured to specifically block that particular protocol at this time (outside of blocking ASNs owned by the VPN provider).

[kokosnh]

Just remember, all trafic is probably loged and archived for later use. Even if it’s hard now to detect, it can be easy later.