Blocking capabilities of circumventing proxies and firewalls via VPN, pptp and l2pt clientware and services

Thanks for your help Labsy and gilrjr.  I was researching a bit about SecurityKiss (one of the vpn software to circumvent proxies and found out the following

-----------------------------------------------------------------------------------------------------
Check your firewall settings if connection is open for SecurityKISS Tunnel (TCP 80, 443 and UDP 123)

You may also check if DHCP client is running. You'll find instructions here
--------------------------------------------------------------------------------------------------------------------
Here is some more on this particular product
--------------------------------------------------------------------------------------
In order to work correctly SecurityKISS Tunnel requires that DHCP Client service is started in your Windows system.

Most Windows configurations have the DHCP Client set to start automatically, however if you can't connect it's worth to check if the service is running.

Below we are showing step by step how to do it on Windows XP but the instruction also applies for other Windows versions.
------------------------------------------------------------------------------------------------------------------

So my question is the following are the folk at securitykiss saying that they actually use port 443 and port 80 to port their traffic through in order to circumvent a proxy setup.  Also I would assume their is no way to allow internet surfacing on approved sites without having dhcp client running.

Lastly if there are only certain sites that we know we want to block while allowing students to effectively do research on the internet for reports, history class and so forth is it safe to say that blocking all ports but 80, 443 and ports dealing with incoming and outgoing email will allow students to have the freedom to do research projects while still being able to black list particular websites such as facebook with the proxy.

I guess what I am saying is by opening ports 80 and 443 while black listing certain sites that are not allowed would vpn and proxy services take advantage of port 80 and 443 in regards to tunnelizing and anonymizing users past the firewall or proxy or do pretty much all free vpns and proxy services use ports other than 8o and 443.

I researched hotspotshield as this is the hottest free vpn used by students at the school now and they definitely do not use port 80 or 443 for their purposes but it almost appears as if securitykiss does which is listed as another popular free vpn tunneling site.



It seems like blocking all but specific white listed sites would only allow students to go to sites a, b, c, and do, etc... for research purposes when doing various projects for school.  I am wondering if their can still be a way to give the students more freedom to properly do research using sites that are very valuable but may not have been discovered as relevant for research while still blocking the social media sites like facebook, twitter, etc... so students while at school will for the most part be forced to focus on the research they are suppose to be doing instead of surfing and chatting. This is why I am wondering if by only opening ports 80 and 443 plus email in and out ports I can pretty much simply black list those popular social networking sites while still have the confidence that anonymizing and tunneling software and services like yourfreedom, hotspotshield and securitykiss can not open up to the students who are going through the schools proxy the ability to tunnel pass and access these social networking sites.

Thanks,

Bo

The problem with allowing port 80/443 and black listing sites is that there are a TON of  anonymous proxy sites that use port 80 and you can still do SSL VPN's using port 443.


So you block facebook through your proxy, then fire up their browsers to to someanonymouseproxy.com or somesslvpnserver.com, connect to it and then access facebook through that proxy.vpn.

Yes it is a pain to block everything and then whitelist, but the alternative is to allow everything and then black list most anonymous proxy servers/ssl VPN servers.

All of these anonymous proxy server and VPN sites know everybody lets port 80 and 443 through, so they use those ports.

Yes, the main concern is that the common practice of proxying port 80 and leaving SSL port 443 to bypass local proxy ends up with huge security risk, because, as told, most of today's VPN proxy services use SSL 443 port for connection and data transmition, bypasing all inspection on enterprise firewall.

There are some expensive SSL proxy firewalls available, but I doubt very much that their content filtering and examination engines are able to cope with millions of VPN software offers across the globe. Cisco and Juniper have some such devices, but subscriptions to daily updates are expensive.
Beside, and not last, these SSL proxy firewalls act as a "trusted man in the middle" inspectors, using known hacking techniques to analyze SSL certificate and parts of stream, which makes the whole ocnversation less trusted. Web site with SSL certificate claims, that connection is trusted... but in such case, it might not be anymore. So, is it legal or not...well, I am not sure.

thank you Labsy and gltjr that was very informative and helpul