Clients bypassing vouchers with VPN

Chris_Low · January 29, 2022, 6:48am

Hi, I am using CNPilots e410 for guest access in our remote hospital in Sudan. We have very limited bandwidth. We use vouchers via CNMaestro. The problem I have is people have figured out how to bypass the voucher system by using zero VPN. If I look on CNMaestro I can see clients connected on the guest access SSID, and their authentication status is false, but they are still downloading and uploading.

I found a similar thread about unifi controllers talking about using zero vpn to bypass their voucher system.

"ZeroVPN is using DNS2TCP to pass traffic over the DNS ports of the network. We don’t block DNS traffic by default as the client needs to be able to resolve domain names such as the controller hostname during guest authentication - and if the client is using a third-party manually configured DNS, blocking it would break the portal for that client.

The solution is to have all traffic that is on port UDP:AnyIP:53 redirected to your router, and configure the router as a DNS forwarder/cacher as necessary."

Does that seem like it would be the vector used against the CNPilot? If so can anyone help me set up a workaround for the CNpilot?

Thanks

Springs · January 29, 2022, 2:40pm

Have not seen this yet…

But from a quick glance… it looks like ZeroVPN uses OpenVPN.
So Blocking port 1194 in UDP should slow them down.

Then black list the servers IP address the ZeroVPN uses.

That should put a stop to it.

Jesse-Nikola · January 31, 2022, 9:38pm

The problem is most VPN providers also host on port 53 because it is almost never blocked

Springs · January 31, 2022, 10:07pm

Could you set up your router to grab any request sent to 53 and redirect it to your router.

I did this in Mikrotik to force people on the guest network to use a “kid safe DNS service.”

When you request an IP from the guest DHCP server. You get the kid safe DNS as your DNS via DHCP. I have a nat rule that grabs any packets sent to port 53 not destined to that kid safe DNS… Gets sent there anyways.

Anandakrishnan · February 1, 2022, 3:34am

A similar issue was observed by one of the ISPs in Southeast Asia, who reported massive amounts of traffic( on port 53) from clients prior to authentication. To mitigate, we recommend allowing just known DNS traffic and blocking all other DNS traffic. At the end of the ACL rule, be sure to allow all IP traffic. Please let me know if you require assistance in setting up the rule in the AP.

Chris_Low · February 1, 2022, 2:31pm

I was thinking something similar, but I am not sure how to set it up. Step by step instructions would be very helpful. It is consuming most of our bandwidth. I have resorted to blocking mac addresses, but it is trivial to spoof a new mac.

Springs · February 1, 2022, 3:09pm

I could post how I did it in Mikrotik routing.

But if you have a solution at the AP…
Could you post that here?

In Tik…

/ip firewall address-list
add address=172.16.69.0/24 list=Guest
/ip firewall nat
add action=accept chain=dstnat comment="Open DNS" dst-address=208.67.222.123 dst-port=53 protocol=udp src-address-list=Guest \
    to-addresses=208.67.222.123 to-ports=53
add action=accept chain=dstnat comment="Open DNS" dst-address=208.67.222.123 dst-port=53 protocol=tcp src-address-list=Guest \
    to-addresses=208.67.222.123 to-ports=53
add action=dst-nat chain=dstnat comment="Redirect Guest DNS" dst-address=!208.67.220.123 dst-port=53 protocol=tcp \
    src-address-list=Guest to-addresses=208.67.220.123
add action=dst-nat chain=dstnat comment="Redirect Guest DNS" dst-address=!208.67.220.123 dst-port=53 protocol=udp \
    src-address-list=Guest to-addresses=208.67.220.123

Anandakrishnan · February 3, 2022, 3:43am

I’ve attached a snippet of conf that allows DNS traffic only to the IP addresses 202.5.117.1 and 192.168.246.1, denies all other DNS (PRECEDENCE 255) traffic from clients , and finally allows all IP traffic (PRECEDENCE 256).

ACL can be configured from the wireless wlan configuration page.

Chris_Low · February 3, 2022, 3:09pm

Is it possible to do this by web UI on cnpilot e410. Could you show a picture of how to do this? I am a little confused by the syntax required.

Thanks

Jesse-Nikola · February 3, 2022, 10:23pm

You probably need to add the TCP protocol as well

Chris_Low · February 4, 2022, 6:09am

Can someone look to see if there is an issue with the acl list I set up via web ui? I set it up on a test network, and I can get a connection through, but I don’t know yet if it will block traffic on 53.

Chris_Low · February 5, 2022, 10:04pm

I got ahold of one of the phones someone was using. They were using an app called thunder vpn. So I downloaded it, and sure enough I can bypass the voucher system. So I used the packet capture and can confirm the data is being passed on port 53. I can’t seem to get the acl list in the web ui to work. Can someone take a look at this and see where I have gone wrong. I want to deny all port 53 traffic not going to my preferred dns, but when I look at the packet capture it is still getting through.

mixig · February 6, 2022, 7:32am

You didnt follow rules of @Anandakrishnan.
Also note precedence numbers, last statement is precedence 256 (Allow_All), Deny_allother_DNS is precedence 255 which is execute before 256

Chris_Low · February 6, 2022, 11:44am

I am getting very strange results using the web ui acl list. If you look at the screen shot I have taken it seems to reverse source port, and Destination IP/Mask. Can someone confirm if these are being reversed or recreate the issue. This is happening for every rule I put.

Anandakrishnan · February 7, 2022, 4:20am

Hi Chris,
Please double-check that the direction you gave is “out” and the description is “in.”
SIP DIP SP DP is the order, therefore the “any” after the IP address 208.67.222.123 is the destination IP. For Protocol, you’ve selected “any” , better way to manage ACL rules is to have independent rules for protocols. So, better to create two sets of rules, one for UDP and the other for TCP.

The IN rule is hitting the AP on the WLAN IN direction, so to allow traffic from client to destination IP address x.x.x.x with port number 53, the rule you should add is

Policy – Permit
direction – IN
proto – UDP/TCP
SIP – any
SP – any
DIP – x.x.x.x
DP – 53

Regards
Anand

Chris_Low · February 7, 2022, 5:35am

Thanks Anand,

I had In and out intuitively backwards in my mind. It still seems like there is an issue with the web ui switching SP and DIP see my last post. Can you look at that and comment?

Thanks
Chris

Anandakrishnan · February 7, 2022, 7:51am

Hi Chris,
Can you please raise a support ticket and share the ID with me. Will join a remote session to explain and fix your problem.

Regards
Anand

Chris_Low · February 7, 2022, 7:29pm

This seems to work at least on my phone. I will check tomorrow when there are people trying to get on. It still seems like the web ui is flipping SP and DIP at least in the way that it is written. I had to add a rule to allow 1.1.1.1 53 or the captive portal login would not popup.