This is part of an internal post by Darren Crithley to the KDI techinican support team which I think if of real value to general public.

The kids at one of the schools are circumventing the NetSentron using this:
http://www.hotspotshield.com/

It is an installable program that becomes a proxy on their own PC and allows them to get past the NetSentron.

It is actually a VPN endpoint with a proxy that runs on your localhost (127.0.0.1)

It is using OpenVPN as a VPN client and they have set up some websites that are the endpoints. So far 68.68.108.3 and 68.68.108.4

There have been a lot of these VPN bypasses showing up of late and this one is pretty slick.

But I am able to block it, so here are the instructions for you to block it:
———————————————————————–
Go to Firewall->IP Block
Choose Protocol:udp
Source IP or network: 68.68.108.0/24
port: *
Drop Packet
Direction: In and Out bound packets
Enabled (yes)

Do the same for TCP
Choose Protocol:tcp
Source IP or network: 68.68.108.0/24
port: *
Drop Packet
Direction: In and Out bound packets
Enabled (yes)

I have probably blocked off more than I should have with the /24, but I figured that they may have a block of IP’s. You can try just the 68.68.108.3 and 68.68.108.4 (udp/tcp)
———————————————————————– 

Now here is the tech part on how to figure this out if the kids are using a different product to bypass:

These bypasses are VPN’s and therefore they need to connect to “somewhere” so they can surf the net. That “somewhere” is what we will block.

If someone is not already using the bypass product, then install it on your laptop or computer.

Next, run it and connect to what should be a banned site.

Then look at the connections analysis on the NetSentron, I suspect you will see a connection to a weird port (either tcp or udp)

Stop the bypass product on the PC or laptop

Add the IP address and ALL ports to IP Block, set in and out packets.

Run bypass product again and see what shows up.

Keep doing this until you get all the IP’s

This hotspot shield was pretty slick, when I blocked all the UDP ports for it, it switched over to TCP and connected again. Once I had the tcp and udp blocked, that was the end of it (until they get another block of ip addresses)

Darren

This update adds 265,651 new entries to the blacklists of the NetSentron.

NOTE: This patch takes a long time to install! Several minutes in fact.  The patch is modifying the Content Filter blacklist files and so it takes a while to go through all the files and update them. Please be patient when installing this update.

This update adds the Advanced Firewall option to the NetSentron. This option will allow you to block all outgoing traffic unless expressly allowed by you. As it is an advanced option, we ask you to make sure you have read the instructions, also an understanding of Network Ports and Protocols is required to manage the advanced firewall.

This update adds to the blacklists of the NetSentron and updates the content filter engine.

NOTE: This patch takes a long time to install! Several minutes in fact. It is also a large patch at about 12 megs, so please try to only install it from your desktop and not across the internet. The patch is modifying the Content Filter configuration files and so it takes a while to go through all the files and update them. Please be patient when installing this update.

The following new categories are added to the blacklists:

astrology – Astrology websites
blog – Journal/Diary websites
books – Various books
celebrity – Websites about celebrities
desktopsillies – Wallpapers and other timewasting items
filehosting – Sites to do with filehosting
filesharing – Sites to do with filesharing
financial – Sites to do with finance and banking
guns – Sites to do with guns and fighting
humor – Sites to do with humor
magazines – Sites to do with Magazines and Ezines
malware – Sites known to contain Malware
manga – Sites containing Manga (Japanese cartoons)
marketingware – Sites containing internet marketing
sect – Sites containing information in sects
shopping – Sites that allow you to shop

You can examine the contents of each category by going to the Filter->Blacklists page and clicking on the link for each category.

NOTE: all new blacklists are set to disabled by default. You must choose Banned, Filtered or Exception for the new categories to take effect.

Added new auto back up feature that allows the NetSentron to automatically generate a back up file each Friday night at 11PM. (Note, on Internet Explorer, the check box will not stay checked, this is fixed in Update 3.3.0)

Fixed some other minor bugs in the NetSentron

Added new analyzer for VPN connections – allows you to see connections and disconnects for all VPN’s or a selected VPN.

Added autoconfigure script to the Proxy page for use with Active Directory Authentication.

This update adds the ability for the NetSentron to join an Active Directory Domain managed by a Microsoft Windows Server 2003 or older. NOTE: Server 2008 is not compatible yet, we’re working on it.

Once you join the Active Directory Domain, you can then authenticate your users against that domain.