Firewall traffic filtering that blocks some necessary services

Question

I study at a college where they use Cyberrom for Internet traffic filtering. I use Open Vpn to connect to my server run by a Webhosting company. The VPN server listens on a 40000+ port. I can connect to Open VPN form the college network. I can work on the Linux CLI without any issue. But if I use rsync or scp to transfer a file up or down, then the open vpn connection gets dropped. Then for about 15 minutes my client cannot establish a connection with the Open Vpn server. So, in order to detect what type of filtering system is used in the college firewall, I made my Open VPN server run on port 443. Then too same issue showed up. If I run a shell command on the hosting server which continuously prints out output on to the shell, then too the VPN connection gets dropped.

I tried ping flood with this command sudo ping -i 0 -n -s 4088 somewanhost.com. The pinging starts, after some responses the pinging suddenly stops.

Web access works fine. Even I can access webpages, also I can download large files via http or https. This made me to think if only tcp is not filtered. So I used hping3 (a tcp ping tool): sudo hping3 somewanhost.com -S -A -F -V -p 80 -i u10000. Here too the ping stops after some time. And I couldn't access web pages from the browser.

I even tried P2P clients. When I tried downloading a Linux distro on Utorrent, after enabling encryption and using a higher port, then it gives connection error. Transmission works fine, if encryption is enabled ( but it takes a long time to detect peers).

If Open Vpn works, then I can access the squid proxy installed on my webserver, and can browse without any issue.

The college does not do domain blocking or ip blocking.

I am curious to know what kind of filtering system is used. More than that, I want to get Open Vpn working, so that I can run my small website hosted on a Webhosts server.

Answer 1

I think it is nearly impossible that they are able to detect what is going on inside the tunnel at a protocol level.

So the most likely explanation is that they are triggering based on the quantity of data that is passing rather than the specific protocol. From what you have described, it is almost always triggered by something that looks non-interactive.

I'll bet if you used squid over openvpn, then tried to download something, if it hit a certain level of data transfer, it would get dropped. This isn't too complex, a basic QoS (quality of service) could be configured to say "if an IP address transfers more than x amount of data over period y for any nonstandard ports, then block for 15 minutes".