Block Hotspot VPN use on Guest Network

[bertthefreak]

Hi,

Just wondering if it's possible to block the use of hot-spot shield on the guest network or altogether. I've noticed that some of the teenagers coming into the premises are using it to bypass the parental controls, firewall and dns filters.

I want to stop them but still allow them to use the network for their homework etc.

I've an AC66U with firmware RT-AC66U_3.0.0.4_374.42_0

Any tips would be appreciated

Thanks
Bert

 

[bertthefreak]

Anyone?

I've found this for another router and was wonder could I apply the same principle using iptables or something.

ip firewall mangle
add action=add-dst-to-address-list address-list=WhiteList \
address-list-timeout=4w2d chain=prerouting comment=WhiteList content=\
!127.0.0.1:895 disabled=no dst-port=80 protocol=tcp
add action=add-src-to-address-list address-list=HotSpotShieldUsers \
address-list-timeout=1h chain=prerouting comment=HotSpotShieldUsers \
content=127.0.0.1:895 disabled=no dst-port=80 protocol=tcp
add action=add-dst-to-address-list address-list=WhiteList \
address-list-timeout=4w2d chain=prerouting comment=WhiteList content=\
!127.0.0.1:895 disabled=no dst-port=443 protocol=tcp

ip firewall filter
add action=log chain=forward comment="Allow WhiteLists" disabled=no \
dst-address-list=WhiteList log-prefix=WhiteLists
add action=accept chain=forward comment="" disabled=no dst-address-list=\
WhiteList
add action=log chain=forward comment="\"Block HotSpot Shield\"" disabled=no \
log-prefix=HotSpotShield src-address-list=HotSpotShieldUsers
add action=drop chain=forward comment="\"Block HotSpot Shield\"" disabled=no \
src-address-list=HotSpotShieldUsers

Here's the source site: Source Site

 

[Builder71]

Would be nice to block VPN services on the guest lan.
The specific service you mention maybe only use port 443, but a lot of VPN providers use all kind of ports. Also port 80 is used for this.

So, destination port blocking doesn't solve the problem.
I guess you need some SPI firewall to fix this issue.
However that is very CPU intensive.
Probably out of the range for the routers we use.

So, let's talk to the teenagers again.