RE: [Openvpn-users] Re: Anyone know how to detect OpenVPN traffic?

["Michael Scheidell" <scheidell () secnap net>]

Security is a process.....
There may be no one good way to block or detect OpenVpn Traffic.
Best Practices should cut the problem down a bit.

Block all outgoing ports be default.
Only allow out what you have to, and only from those servers and workstations necessary.
Example: only allow port 25 out on mail servers, port 53 out on dns servers, udp port 123 on your ONE OR TWO internal 
time servers.

Workstations could be allowed out 80 and 443 (redirecting time and dns services internally) or sent to the corporate 
proxy server.

The above would block arbitrary outgoing ports.

An application inspection firewall like a CyberGuard would (I hope?) detect the non HTTPS type traffic on port 443 or 
none HTTP traffic on port 80 (Anyone with a CyberGuard care to comment?)

A packet shaping proxy server might be able to set bandwidth allocation to 0 if it didn't see valid http traffic.

Windows workstations can't run unless using Administrative privileges. Take that away from standard users!.

You might need 'nessus' or something to detect the OpenVpn 'service'.  In fact, a nessus plugin could be written to 
detect the win32 taps I suspect.

Try connecting to known openvpn port, watch the outbound 'heartbeat' traffic.



-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users