stop vpn connection

amsteen · May 9, 2009, 10:03am

Did any one know how to stop the vpn connection on MK 3.23

Amgad

iwantlemonjuice · May 9, 2009, 11:05am

what do you mean?

Chupaka · May 9, 2009, 3:35pm

disable your pptp-client interface

amsteen · May 10, 2009, 6:53am

I mean I have many users in my network connection to vpn throught MK3.23 server.

How to stop them
where is the pptp-client interface

Thanks
Amgad

iwantlemonjuice · May 10, 2009, 8:36am

remove manually in active connection

normis · May 11, 2009, 7:57am

if they connect “through” your router (ie. from their PC to some unknown PPTP server) then you can’t stop them.

Chupaka · May 11, 2009, 8:56am

why not? just block TCP 1723 and GRE protocols

normis · May 11, 2009, 9:08am

well, we don’t know what kind of VPN that is. There are many kinds. You will end up blocking too much stuff

amsteen · May 12, 2009, 6:23am

Then from where I can block TCP 1723 and GRE protocols, I do not
care about stop too much stuff.

I am using the web-proxy on my MK server.

Amgad

normis · May 12, 2009, 6:34am

/ip firewall filter add chain=forward protocol=gre action=drop

amsteen · May 13, 2009, 5:49am

I try the code and it work but as you say for some kind
Of vpn only.

I wonder if there is some way to stop all the vpn connections with any type.

thanks.

Eng. Amgad

Chupaka · May 13, 2009, 9:26am

of course, no. what if somebody will tunnel VPN via HTTP? =) will you block all HTTP?

amsteen · May 13, 2009, 10:02am

Yes tunnel VPN via HTTP can not be stop or I will you block all HTTP

But you know I was working on isa2006 before and it blocks all kind of
VPN by default, so I have to add rules to open what I want.

Thanks for your respond

Eng. Amgad

normis · May 13, 2009, 10:04am

RouterOS doesn’t block anything by default, you have to add rules to block certain things. You have to find out what protocols and ports those VPNs use, and make according firewall rules. Use the one I posted as reference for other rules.

mrz · May 13, 2009, 10:11am

You can do the same in mikrotik by blocking default vpn ports.

Here you can find list of all assigned ports
http://www.iana.org/assignments/port-numbers

normis · May 13, 2009, 10:13am

the only problem will be with SSL tunnels, if such things are used in your network. By blocking those ports, some websites will no longer work (HTTPS)

loveman · April 26, 2016, 9:41pm

Any one have ideo to block psiphone vpn program?

chechito · April 26, 2016, 9:44pm

using opendns

block the Proxy/Anonymizer category and that can help

loveman · April 27, 2016, 10:31pm

Please write your method in the post