NetFort Advertising

How to Passively Detect VPN Clients on Your Network

How to detect the presence of VPN clients

Why worry about VPN clients?

VPNs have been around for a long time. A VPN extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Applications running across the VPN may therefore benefit from the functionality, security, and management of the private network.

If you use public WiFi networks such as those found in airports and cafes then it is recommended that you use a VPN service. A VPN will ensure that all of your communication is encrypted.

However, there are times when VPN activity is suspicious and/or bad. I see an increasing amount of VPN actvity on college\school networks. In most cases end users are using a VPN to get around a web filter or use a blocked application such as Bittorrent. A VPN will also punch a hole in your firewall and it may become a route for nasties such as Ransomware.

“A VPN client will punch a hole through your firewall”

Common uses for VPN clients

Good

  1. Site to site connectivity where a branch office can connect to HQ via the Internet
  2. Allows remote workers to connect to HQ
  3. Encrypts your data when you are on a public WiFi network

Bad

  1. Bypass web filters (some may not see this as bad)
  2. Allows you to run applications which are blocked
  3. Create a hole in a Firewall which may become the source of a Malware infection
  4. Can be used for data exfiltration

How to detect VPN clients on your network

VPN clients can be difficult to detect as they typically use a port such as 443 over UDP or TCP which is normally open on a firewall. However, there are a number of things to watch out for. First we need to understand how the most common VPN clients work.

Most VPN clients come as a software pack which include the actual VPN software and a database of VPN servers. The idea is that everything you need is included when you install so you don’t need to access a specifc website to connect to anything. If you did it would be easy to block access to these websites. This makes it hard to detect VPN clients if you are looking at reports from something like a web filter.

Once you select a VPN server, an encrypted connection is created between your client and the VPN server. All of your Internet bound activity is then routed through this VPN connection. If you want to browse a website for example, the VPN server connects to the website and sends the text\images\media back to you via your encrypted connection. This is what makes them secure, someone ‘sniffing’ your local traffic can’t see what you are accessing.

How VPN works

In summary, a VPN client makes a direct connection to a VPN server and this server then does the job of accessing what service\application your requested. This differs from users connecting to websites or applications directly. For example I may go and visit YouTube using a web browser. When I type in YouTube.com my computer will go and resolve this name to an IP address using DNS. Computers use IP addresses to connect, not human readable names.

In order to detect VPN clients on a network, we need to watch out for any client sessions where there is client to server connections with no DNS resolutions. To do this you need to monitor network traffic going to and from your Internet gateway and you also need to monitor DNS traffic hitting your DNS servers if you host them locally.

Detecting VPN Clients

  1. Monitor Internet traffic
  2. Monitor DNS queries
  3. Watch out for client connections to external hosts with no name resolution

What you need to watch out for is any sessions to external IP addresses which have no hostnames associated with the server. If the connection is over TCP or UDP port 443 then you are probably looking at VPN client activity. The image below shows an example of what to watch out for if you want to detect VPN clients. The first client listed is connecting directly to an IP address as no hostname is shown. The other connections are to Googlevideo which are part of the YouTube service.

Report showing a VPN client connecting to an external VPN server

Check out the video below to learn more about how you can use our LANGuardian product to detect VPN clients.