RE: [Openvpn-users] Re: Anyone know how to detect OpenVPN traffic?

Security is a process.....
There may be no one good way to block or detect OpenVpn Traffic.
Best Practices should cut the problem down a bit.

Block all outgoing ports be default.
Only allow out what you have to, and only from those servers and workstations 
necessary.
Example: only allow port 25 out on mail servers, port 53 out on dns servers, 
udp port 123 on your ONE OR TWO internal time servers.

Workstations could be allowed out 80 and 443 (redirecting time and dns services 
internally) or sent to the corporate proxy server.

The above would block arbitrary outgoing ports.

An application inspection firewall like a CyberGuard would (I hope?) detect the 
non HTTPS type traffic on port 443 or none HTTP traffic on port 80 (Anyone with 
a CyberGuard care to comment?)

A packet shaping proxy server might be able to set bandwidth allocation to 0 if 
it didn't see valid http traffic.

Windows workstations can't run unless using Administrative privileges. Take 
that away from standard users!.

You might need 'nessus' or something to detect the OpenVpn 'service'.  In fact, 
a nessus plugin could be written to detect the win32 taps I suspect.

Try connecting to known openvpn port, watch the outbound 'heartbeat' traffic.

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus