5

I have a Sonicwall firewall. I want to block the Psiphon mobile and PC applications.
I denied access on these ports: 51,5242,4244,5243,9785,1701,47,443,500,4500,1080
Most VPNs are closed but the Psiphon app still works; how I can block it?

Improve this question
2
  • I never had any problems with connection speeds or buffers with Psiphon. Maybe it should be tested again this year as it has improved a lot. Note: the Psiphon is blocking for only devices in which we install the self-sign certificate.
    – Jerry Lou
    Jan 18, 2019 at 10:44
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 23:08

7 Answers 7

Reset to default
4

I'm quoting what is posted on the Psiphon page:

You can only establish connections via Psiphon by using the following ports: 53, 80, 443, 554, 1935, 7070, 8000, 8001, 6971-6999.

  1. If you block these ports, you will also be blocking a lot of services in your network.

  2. You need to do Deep Packet Inspection if you want your really block Psiphon.

https://psiphon.ca/es/faq.html

Improve this answer
1
  • i tried to block all this port the web page failed to access internet but psiphon connected successfully :D
    – Hani
    Sep 30, 2015 at 5:42
2

I work with a High School and some of the students are using Psiphon to get around our web filter. So I believe we were having a similar issue. We found that A third party managed firewall and web filter filled our needs better than closing so many ports that have important services running on them. We used iboss for our web filter and firewall and we were able to curtail the problem with Psiphon.

Improve this answer
2
  • thank you for your replying , can you explain more about iboss
    – Hani
    Sep 30, 2015 at 5:38
  • I will post a link to their site but I dont want to violate forum rules so I.ll just say they are a paid for firewall, web and spam filter. You can find out more information and contact them through this site link
    – James Studer
    Oct 2, 2015 at 8:50
2

If you want to block this application, you must block all VPNs which are not yours.

Psiphon can mount proxy HTTP/SOCKS via tunnels. All the traffic of this application will bypass the port TCP 80 by default. So you must to have a firewall capable to inspect your packets to see which packets are real HTTP packets and HTTP proxy packets.

You can't block this application only with port numbers.

Improve this answer
0

To be Honest, with my experience using and testing Psiphon, As long as the user has any kind of internet, no matter the block (even if though), Psiphon seems to manage it's way in anyway. It's lightweight setup make you able to use on a flashdrive (so it doesn't need to be installed on the PC at all, just need to plug in thumbdrive) and versatility makes it very hard to block, even temporally. not to mention that if it even get a ping from any open sever, it automatically updates itself, makes a backup copy, and gets new sever list. The reason why it's like this is because, it's designed to allow you access even in a another country where blocks are really strict... Basically, you're trying to march though the jungle but, up against an army that specializes in guerrilla warfare...

Improve this answer
0

If you want to block this application, you will must to block all VPN which are not yours. You may check this detailed guide on Psiphon here or just follow the steps below to unblock the app:--

  1. Enable DPI-SSL Client Inspection by going to DPI-SSL | Client SSL and selecting Enable SSL Client Inspection. Ensure that IPS, GAV, Spyware, and Application Firewall are selected.
  2. Enable all Psiphon application signatures by going to Firewall | App Control Advanced. Select the category PROXY-ACCESS and application Psiphon. Configure the application to be blocked and logged.
  3. Also block Encrypted Key Exchange TCP Random Traffic (SID 5).
  4. Enable blocking of SSH app signature (SID 10097) "SSH -- Client Request Outbound", (or make access rule to block outbound TCP/22 SSH Service from LAN->WAN).
Improve this answer
0

Ok folks, so here it is. After fighting this monster for about 9 months, I finally figured out how to stop PSiphon from running on my computers. PSiphon is a standalone program, because it does not install itself to the computer, there are no hash's or certificates to manipulate. I finally google'd how to stop .exe files from running and low and behold there it was. You have to set up a GPO to prevent psiphon3.exe from running. You will create this rule under the user configuration\administrative templates\system\Don't run specified windows application. From here you can figure out the rest. Now I have tried to run it on the computer, from the website and from a drive stick and they all failed to run. Can't wait for morning to get here so I can implement this on the computers at work. Hope this helps.

Improve this answer
2
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin ♦
    Aug 30, 2018 at 3:57
  • Couldn't they just rename the .exe as a workaround?
    – Elon Zito
    Nov 19, 2021 at 19:45
0

I have managed to do this by blocking the file path of the temp exe it creates when connecting. This removes the ability to rename the original exe and it works again (or having duplicates in downloads, i.e. "Psiphon3 (1).exe").

Use User or Computer policy,

Policies/Windows Settings/Security Settings/Software Restriction Polices/Additional Rules

New Path Rule -> %userprofile%\AppData\Local\Temp\psiphon-tunnel-core.exe

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.