Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I study at a college where they use Cyberrom for Internet traffic filtering. I use Open Vpn to connect to my server run by a Webhosting company. The VPN server listens on a 40000+ port. I can connect to Open VPN form the college network. I can work on the Linux CLI without any issue. But if I use rsync or scp to transfer a file up or down, then the open vpn connection gets dropped. Then for about 15 minutes my client cannot establish a connection with the Open Vpn server. So, in order to detect what type of filtering system is used in the college firewall, I made my Open VPN server run on port 443. Then too same issue showed up. If I run a shell command on the hosting server which continuously prints out output on to the shell, then too the VPN connection gets dropped.

I tried ping flood with this command sudo ping -i 0 -n -s 4088 somewanhost.com. The pinging starts, after some responses the pinging suddenly stops.

Web access works fine. Even I can access webpages, also I can download large files via http or https. This made me to think if only tcp is not filtered. So I used hping3 (a tcp ping tool): sudo hping3 somewanhost.com -S -A -F -V -p 80 -i u10000. Here too the ping stops after some time. And I couldn't access web pages from the browser.

I even tried P2P clients. When I tried downloading a Linux distro on Utorrent, after enabling encryption and using a higher port, then it gives connection error. Transmission works fine, if encryption is enabled ( but it takes a long time to detect peers).

If Open Vpn works, then I can access the squid proxy installed on my webserver, and can browse without any issue.

The college does not do domain blocking or ip blocking.

I am curious to know what kind of filtering system is used. More than that, I want to get Open Vpn working, so that I can run my small website hosted on a Webhosts server.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I think it is nearly impossible that they are able to detect what is going on inside the tunnel at a protocol level.

So the most likely explanation is that they are triggering based on the quantity of data that is passing rather than the specific protocol. From what you have described, it is almost always triggered by something that looks non-interactive.

I'll bet if you used squid over openvpn, then tried to download something, if it hit a certain level of data transfer, it would get dropped. This isn't too complex, a basic QoS (quality of service) could be configured to say "if an IP address transfers more than x amount of data over period y for any nonstandard ports, then block for 15 minutes".

share|improve this answer
    
I can download a large file from an https enabled site. But, when I connect to my VPN server over port 443, the connection gets dropped. –  nixnotwin Dec 5 '11 at 13:43
    
Openvpn over 443 looks a lot different to https. Can you download a large file via squid over Openvpn? (it doesn't mattter which port you are connecting on if this theory is correct) –  Paul Dec 5 '11 at 21:08
    
Yes, I cannot download a large file via squid over openvpn. As I can access websites (both http and https) and do http downloads, what would be the best way to access my server? –  nixnotwin Dec 9 '11 at 14:17
    
Well your problem doesn't seem to be accessing it, but doing any kind of activity that causes sustained data transfer, is that right? –  Paul Dec 9 '11 at 22:50
    
By default my openvpn was running on udp. I changed it to tcp and then the firewall did not drop the connection. Even running it over tcp on a higher port worked as well. So, if the firewall detects any udp traffic, the connection gets dropped. So the issue is solved. –  nixnotwin Jan 13 '12 at 9:58
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.