DOCSLIB.ORG

Obfuscating VPN Traffic

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Obfuscating VPN Traffic Obfuscating VPN Traffic JJF Derksen August 22, 2018 Supervisor: dr. ir. Marc X. Makkes Universiteit van Amsterdam Rogier Spoor SURFnet Host organisation: SURFnet, https://www.surf.nl Universiteit van Amsterdam Faculteit der Natuurwetenschappen, Wiskunde en Informatica Master Software Engineering http://www.software-engineering-amsterdam.nl Contents Abstract 3 1 Introduction 4 2 Related work 6 3 Background 7 3.1 Network traffic ........................................ 7 3.2 Virtual private network ................................... 8 4 Experiment setup 11 4.1 Setups............................................. 11 4.2 Experiments.......................................... 12 4.2.1 Experiment one: OpenVPN server detection.................... 12 4.2.2 Experiment two: network traffic monitoring.................... 12 4.3 OpenVPN configurations .................................. 13 4.3.1 OpenVPN standard configuration.......................... 13 4.3.2 OpenVPN secure configuration........................... 15 4.3.3 OpenVPN obfuscation configuration........................ 15 4.3.4 OpenVPN TLS 1.3 configuration.......................... 16 5 Results and analysis 17 5.1 Active detection OpenVPN server ............................. 17 5.1.1 Port scanning..................................... 17 5.1.2 Connection request.................................. 17 5.1.3 TCP three way handshake.............................. 18 5.2 Monitoring network traffic.................................. 18 5.2.1 Handshake ...................................... 18 5.2.2 Client hello...................................... 18 5.2.3 Server hello...................................... 20 5.3 Network traffic from server to client ............................ 21 5.4 Network traffic from client to server ............................ 21 5.5 Analysis............................................ 22 5.5.1 Active detection OpenVPN server ......................... 22 5.5.2 Network traffic.................................... 22 5.5.3 TCP three way handshake.............................. 22 5.5.4 OpenVPN setups compared............................. 22 5.5.5 TLS compared to OpenVPN ............................ 23 6 Conclusion 24 7 Future work 26 Bibliography 27 1 A Abbreviations 31 B OpenVPN Headerinfo 32 C Listing results 34 2 Abstract Virtual private network (VPN) connections ensure privacy as well as security between two connected computers on the Internet. However some countries and companies do not allow the use of VPN connections and use a firewall to prevent the use of VPN. Header information of network traffic from VPN connections contains recognisable characters. Firewalls can use these recognisable characters to detect VPN connections. To avoid VPN connections being actively used, firewall setups can limit these connections in different ways, for example: connections can be down throttled, disconnect by sending termination packets or blocked completely. When VPN connections can no longer be used, users would lose privacy and security of the internet connection. To prevent detection, VPN traffic could be obfuscated to mimic the same patterns as Transport Layer Security (TLS) traffic.This thesis investigates various OpenVPN solutions created. The solutions obfuscate the VPN related header information characters of a connection. In addition, we show that VPN servers can be configured such that they are undetectable, except for authorized users. The results of this thesis show that VPN servers can remain undetected for any unauthorised user when recognisable header information characters of VPN connections are obfuscated. Despite this obfuscation there are still vulnerabilities making it is still possible to detect VPN connections. The detection of VPN connections is accom- plished by monitoring network traffic on various OpenVPN servers. The Thesis results on the various OpenVPN servers are compared to the network traffic of TLS connections. 3 Chapter 1 Introduction Internet traffic is subject to monitoring. Monitoring of network traffic happens when using the internet in a company with strict firewall rules or in a country that enforces strict firewall rules, such as China [NS14] or Iran [AAH13]. All network traffic passing the firewall will be initially monitored on header information. When creating an internet connection within a network with firewall rules, these rules determine which network traffic is passed through and which network traffic will be throttled, disconnect or blocked [SB14]. In addition, the network enclosed by the firewall can determine your geographical location by using the internet protocol (IP) address of a client request. To protect against firewalls throttling, disconnecting or blocking network traffic, a virtual private network (VPN) connection can be used when exchanging network traffic. A VPN connection provides secure communication over an unsecured internet connection. This is done by creating a virtual tunnel between the source, the client device, and the endpoint, the VPN server. The endpoint will act as the origin of the traffic request. This masks the true origin of a user request. This makes it impossible to determine the origin of a traffic request made from a VPN end- point. The network traffic between client and VPN server is encrypted. Therefore, firewalls are not able to distinguish network traffic as anything other than VPN network traffic. When users want to create a VPN connection, they can choose among multiple VPN protocols. The most common proto- cols are internet protocol security (IPSec) [Ken05], point-to-point protocol (PPTP) [HPV+99], layer 2 tunnel protocol (L2TP) [TVR+99] and VPN solutions that use a hybrid form of the aforementioned procols, like OpenVPN [Kei17]. A VPN client can initiate a VPN connection by starting a handshake. This handshake is an in- teractive agreement to use a specific protocol and parameters. On completion a secure cryptographic communication channel is established. VPN network traffic has VPN related characters, which makes it distinguishable from other network traffic. Firewalls monitoring network traffic can pick up on these characters when analysing network traffic, thereby making it possible for a firewall to detect VPN connections [PBUK07, GLMG16, PJL+12]. If the encryption algorithm is secure, the payload remains secret. However, since the initiating of a VPN connection or an existing connection can be detected, firewalls that disallow the use of a VPN can throttle, disconnect or block the VPN server. This makes it impossible for users to freely interact with the internet in a secure and anonymous way on any network. Therefore, we aim to present a solution to prevent a VPN server from being detected as well as the network traffic of the VPN server. As long as the VPN server and its connections will not be detected there is no reason to block or destroy any connection to the VPN server. This thesis will therefore investigate the obfuscation of an OpenVPN connection, making it possible for user to always create a private internet connection. The OpenVPN connection will be obfuscated by encrypt- ing VPN related characters and converting the network traffic to resemble a transport layer security (TLS) connection. TLS uses the transmission control protocol (TCP) [Pos81] to transport network traffic; therefore, we obfuscate the OpenVPN network traffic using the TCP protocol in OpenVPN. The differences in protocols will be described and a solution to obfuscate the OpenVPN network traffic will be presented. In this thesis, we make the following contributions • Creating VPN servers that are undetectable by any unauthorised users (Section 4.3). Various 4 VPN server setups are tested on their detectability (Section 5.2). • Monitoring the network traffic of various OpenVPN servers. The differences in network traffic are shown. • Analysing VPN network traffic and TLS network traffic. The differences in network traffic are compared using the various OpenVPN servers connections and a TLS connection. We aim to configure a VPN server that will not be detected, when it is running on a server and the server is exchanging network traffic with a client. The VPN server will not be blocked and connections will not be destroyed. Users will alway be able to create a private and secure internet connection using the VPN server. Through the contributions and by creating an undetectable VPN server we aim to answer the following research question: How can one hide a VPN connection to prevent a third party from detecting, destroying or blocking the connection between a client and a VPN server? To help answer this research question, these sub-questions have been formulated: • How can an OpenVPN server be detected? • How can a VPN connection be detected? • Which criteria should hold to improve obfuscation of an OpenVPN connection? The rest of the paper is organised as follows. The related work is presented in Chapter2, followed by the protocols of the technologies used presented in Chapter3. Chapter4 describes the experiments designed to explore the OpenVPN configuration to be tested. Chapter5 presents the results of the experiments conducted. An analysis of these results is then conducted and discussed. Chapter6 answers the research question and sub-questions. Suggestions for future work to obfuscated VPN connections are discussed in Chapter7. 5 Chapter 2 Related work To ensure that a VPN connection will not be detected, a VPN server, as well as the connection, should be indistinguishable from a TLS connection. The detection of a VPN server is performed using "active probing". Ensafi et al. [EFW+15] describe
Load more

Recommended publications
  • Flexgw Ipsec VPN Image User Guide
    FlexGW IPsec VPN Image User Guide Zhuyun Information Technology Co.,Ltd. www.cloudcare.cn Zhuyun Information Technology Co.,Ltd. Contents .......................................................................................................... .................................................................................................................. 1 Introduction 4 1.1 Software Compon.e..n..t.s................................................................................................................... 4 1.2 Login Description ................................................................................................................... 4 1.3 Function Description ....................................................................................................5 1.4 Typical Scenarios Des..c..r..i.p..t..i.o..n......................................................................................................5 1.5 Program Description .................................................................................6 1.6 Software Operation Command Summary ............................... 7 ............................................................................................................... 2 IPSec Site-to-Site VPN User Guide (VPC network scenario) 8 2.1 Start IPSec VPN.s..e..r..v..i.c..e.................................................................................................................8 2.2 Add new tunnel .................................................................................................................
    [Show full text]
  • Openvpn with Two-Factor Authentication (2FA)
    Portal > Knowledgebase > VPN > OpenVPN > OpenVPN with Two Factor Authentication (2FA) OpenVPN with Two Factor Authentication (2FA) Dmitriy Eshenko - 2021-09-21 - 0 Comments - in OpenVPN Using DUO 2fa with OpenVPN requires to install an additional plugin. Upload tar archive to your router then unarchive required plugins and helper files curl http://dev.packages.vyos.net/tmp/openvpn-plugin-duo_2.4_amd64.deb -O sudo dpkg -i openvpn-plugin-duo_2.4_amd64.deb Following documentation from DUO site, configure OpenVPN instance https://duo.com/docs/openvpn Get integration key, secret key, and API hostname from DUO control panel and add to VyOS the next commands for activating the plugin. set interfaces openvpn vtunX openvpn-option '--plugin /usr/lib/openvpn/duo/duo_openvpn.so IKEY SKEY HOST' set interfaces openvpn vtunX openvpn-option 'reneg-sec 0' Where: IKEY - integration key, SKEY - secret key, HOST - API hostname Full OpenVPN configuration: set interfaces openvpn vtun10 local-port '1194' set interfaces openvpn vtun10 mode 'server' set interfaces openvpn vtun10 openvpn-option '--plugin /usr/lib/openvpn/duo/duo_openvpn.so XXX YYY api-zzz.duosecurity.com' set interfaces openvpn vtun10 openvpn-option 'reneg-sec 0' set interfaces openvpn vtun10 persistent-tunnel set interfaces openvpn vtun10 protocol 'udp' set interfaces openvpn vtun10 server push-route '100.64.0.0/24' set interfaces openvpn vtun10 server subnet '10.23.1.0/24' set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ovpn/ca.crt' set interfaces openvpn vtun10 tls cert-file '/config/auth/ovpn/central.crt' set interfaces openvpn vtun10 tls crl-file '/config/auth/ovpn/crl.pem' set interfaces openvpn vtun10 tls dh-file '/config/auth/ovpn/dh.pem' set interfaces openvpn vtun10 tls key-file '/config/auth/ovpn/central.key' How to generate cryptographic materials described by the following link https://support.vyos.io/en/kb/articles/using-easy-rsa-to-generate-x-509-certificates-and-keys -2.
    [Show full text]
  • N2N: a Layer Two Peer-To-Peer VPN
    N2N: A Layer Two Peer-to-Peer VPN Luca Deri1, Richard Andrews2 ntop.org, Pisa, Italy1 Symstream Technologies, Melbourne, Australia2 {deri, andrews}@ntop.org Abstract. The Internet was originally designed as a flat data network delivering a multitude of protocols and services between equal peers. Currently, after an explosive growth fostered by enormous and heterogeneous economic interests, it has become a constrained network severely enforcing client-server communication where addressing plans, packet routing, security policies and users’ reachability are almost entirely managed and limited by access providers. From the user’s perspective, the Internet is not an open transport system, but rather a telephony-like communication medium for content consumption. This paper describes the design and implementation of a new type of peer-to- peer virtual private network that can allow users to overcome some of these limitations. N2N users can create and manage their own secure and geographically distributed overlay network without the need for central administration, typical of most virtual private network systems. Keywords: Virtual private network, peer-to-peer, network overlay. 1. Motivation and Scope of Work Irony pervades many pages of history, and computing history is no exception. Once personal computing had won the market battle against mainframe-based computing, the commercial evolution of the Internet in the nineties stepped the computing world back to a substantially rigid client-server scheme. While it is true that the today’s Internet serves as a good transport system for supplying a plethora of data interchange services, virtually all of them are delivered by a client-server model, whether they are centralised or distributed, pay-per-use or virtually free [1].
    [Show full text]
  • Openvpn® Settings Page - Simple Mode
    Grandstream Networks, Inc. WP820 Enterprise Portable Wi-Fi Phone OpenVPN® Guide Table of Contents OVERVIEW ..................................................................................................................... 3 ENABLE OPENVPN® FEATURE ................................................................................... 4 OPENVPN® MODES ...................................................................................................... 4 Simple Mode ........................................................................................................................4 Professional Mode (Expert Mode) ........................................................................................6 Table of Figures Figure 1: VPN Architecture Overview ....................................................................................................... 3 Figure 2: OpenVPN® Settings Page - Simple Mode ................................................................................. 4 Figure 3: OpenVPN® Settings Page - Expert Mode ................................................................................. 6 Figure 4: Expert Mode ZIP file ................................................................................................................. 6 Table of Tables Table 1: OpenVPN® Settings – Simple Mode ........................................................................................... 5 P a g e | 2 WP820 OpenVPN® Guide OVERVIEW VPN (Virtual Private Network) is a network that communicates by creating a dedicated and
    [Show full text]
  • Wireguard in Eduvpn Report
    WireGuard in eduVPN Report Nick Aquina SURF, Utrecht Fontys University of Applied Sciences, Eindhoven INTERNSHIP REPORT FONTYS UNIVERSITY OF APPLIED SCIENCES HBO-ICT Data student: Family name, initials: Aquina, N Student number: project period: (from – till) 31 August 2020 – 22 January 2021 Data company: Name company/institution: SURF Department: Team Security Address: Kantoren Hoog Overborch, 3511 EP Utrecht, Moreelsepark 48 Company tutor: Family name, initials: Spoor, R Position: (Tech) Product Manager University tutor: Family name, initials: Vos, A Final report: Title: WireGuard in eduVPN Date: 12 January 2021 Approved and signed by the company tutor: Date: 12 January 2021 Signature: Preface This report is written for my internship for Fontys. The internship was done at SURF for the eduVPN project. My task was to build a proof of concept in which WireGuard is integrated into eduVPN. This internship took place from September 2020 until January 2021. I would like to thank Arno Vos for his guidance and feedback throughout this internship. I would also like to thank Rogier Spoor for guiding me throughout this internship and inviting me to meetings which gave me a valuable insight into cyber security and technological issues facing members of SURF. And last, but not least, I would like to thank François Kooman for all technical support, advice and code reviews which helped improve the project. All blue text can be clicked to open a hyperlink. 1 Contents Preface . .1 Summary 4 Introduction 5 Free software . .5 The company (SURF) 6 Project 7 Context / Initial situation . .7 Project goal . .7 Assignment . .7 Constraints . .8 Development strategy .
    [Show full text]
  • Nist Sp 800-77 Rev. 1 Guide to Ipsec Vpns
    NIST Special Publication 800-77 Revision 1 Guide to IPsec VPNs Elaine Barker Quynh Dang Sheila Frankel Karen Scarfone Paul Wouters This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-77r1 C O M P U T E R S E C U R I T Y NIST Special Publication 800-77 Revision 1 Guide to IPsec VPNs Elaine Barker Quynh Dang Sheila Frankel* Computer Security Division Information Technology Laboratory Karen Scarfone Scarfone Cybersecurity Clifton, VA Paul Wouters Red Hat Toronto, ON, Canada *Former employee; all work for this publication was done while at NIST This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-77r1 June 2020 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
    [Show full text]
  • Comparison of Virtual Networks Solutions for Community Clouds
    KTH Royal Institute of Technology Bachelor Thesis Comparison of Virtual Networks Solutions for Community Clouds Examiner: Vladimir Vlassov Author: Albert Avellana Supervisors: Paris Carbone, Hooman Peiro Information and Communication Technology School February 2014 KTH Royal Institute of Technology Abstract Information and Communication Technology School Bachelor Thesis Comparison of Virtual Networks Solutions for Community Clouds by Albert Avellana Cloud computing has a huge importance and big impact nowadays on the IT world. The idea of community clouds has emerged recently in order to satisfy several user expectations. Clommunity is a European project that aims to provide a design and implementation of a self-configured, fully distributed, decentralized, scalable and robust cloud for a community of users across a commmunity network. One of the aspects to analyze in this design is which kind of Virtual Private Network (VPN) is going to be used to interconnect the nodes of the community members interested in access cloud services. In this thesis we will study, compare and analyze the possibility of using Tinc, IPOP or SDN-based solutions such as OpenFlow to establish such a VPN. Acknowledgements I would like to express my gratitude to all those who gave me the possibility to do this thesis in KTH. Firstly, I would like to thank Vlad for the opportunity he gave me to do this thesis and for his support. Secondly, thanks to my thesis supervisors: Paris Carbone and Hooman Peiro, who guided me through the research, helped me and gave me recommendations during this period. Also, I would like to thank F´elixFreitag and Leandro Navarro from Universitat Polit`ecnica de Catalunya for supporting me from Barcelona and make this stay in Stockholm possi- ble.
    [Show full text]
  • Openvpn Client LAN Internet
    Setting an OpenVPN on Linux and MikroTik to securely access a web server Teddy Yuliswar MikroTik Certified Trainer #TR0442 Indonetworkers.com Training Center (ITC) Jl. S. Parman No. 189B Ulak Karang Utara Padang – West Sumatera - Indonesia Indonetworkers.com/training Case 1. We want to have a web-based application that is on a server that can only be accessed by office employees - our branch offices (not allowed to be accessed publicly) or 2. We want to manage client routers that do not have public ip via a single web based app Problem At the Head Office and Branch (both) there is no dedicated internet for example : 1. From ISP Dynamic Internet IP 2. Under the NAT Router / Does not have a public IP What do we need to solved this problem? What are the steps? What is OpenVPN? Symmetric Encryption Example Symmetric Encryption • Blowfish, AES, RC4, DES, RC5, and RC6 • The most widely used now AES-128, AES-192, and AES-256. Asymmetric Encryption Example Asymmetric Encryption Most are used in everyday communication channels, especially through the Internet. Popular asymmetric key encryption : EIGamal, RSA, DSA, Elliptic curve techniques, PKCS Why OpenVPN? OpenVPN PPTP L2TP/IPsec SSTP IKEv2/IPSec Encryption 160-bit, 256-bit 128-bit 256-bit 256-bit 256-bit Weak High security (might Security Very high High High be weakened by NSA) Speedy, due to low Medium, due to Fast Fast Very fast Speed encryption double encapsulation Stability Very stable Very stable Stable Very stable Very stable Strong desktop Windows- Limited platform support, but mobile Strong Windows Multiple device and platform, but works support beyond Compatibility could be improved.
    [Show full text]
  • LAB – Open VPN Introduction
    LAB – Open VPN Introduction Virtual Private Network is a special network setup aimed to provide high level of confidentiality and integrity protection for data traffic exchanged between hosts or gateways. It is especially usefull in cases, when data transfer is carried out across the public Internet. OpenVPN Access Server (https://openvpn.net/ ) is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client software packages that accommodate Windows, MAC, and Linux OS environments. OpenVPN Access Server supports a wide range of configurations, including secure and granular remote access to internal network and/ or private cloud network resources and applications with fine-grained access control. Steps 1. First step: boot the computer in Windows. Create a new folder on the Desktop, for example “VPN”. Use it to store all files used throughout the lab. 2. Download OpenVPN from http://www.kt.agh.edu.pl/~niemiec/lab/lab6/ and install OpenVPN. 3. Use C:\Program Files\OpenVPN\easy-rsa to generate certificates, which will be used to set up secure VPN connection. Execute command: init-config. A new file will appear: vars.bat. Edit the file to configure all parameters: KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG and KEY_EMAIL. Note that the file contains, among other things, the length of a key. 4. Create a new certificate authority with the following commands: vars clean-all build-ca While executing the ‘build-ca’ command, you will be prompted to provide parameters previously defined in file vars.bat. It is enough just to confirm them.
    [Show full text]
  • Openvpn Access Server System Administrator Guide
    OpenVPN Access Server System Administrator Guide COPYRIGHT NOTICE Copyright OpenVPN Technologies ©2010 OpenVPN Access Server System Administrator Guide ii TABLE OF CONTENTS 1 Introduction ........................................................................................................................ 2 1.1 Access Server Deployment Topology .............................................................................. 2 1.2 Access Server Deployment Terminology ......................................................................... 3 1.3 Deployment Overview (Quick Start) ................................................................................ 4 2 OpenVPN Access Server Operation ............................................................................... 5 2.1 Services and TCP/UDP Ports ........................................................................................... 5 2.2 Typical Network Configurations ...................................................................................... 5 2.2.1 One Network Interface on Private Network Behind the Firewall ............................... 6 2.2.2 Two Network Interfaces, One on Public and One on Private Network ....................... 6 2.2.3 One Network Interface on Public Network ................................................................ 7 2.3 User Authentication and Management ............................................................................. 8 2.4 Client Configuration Generation and Management ..........................................................
    [Show full text]
  • Connecting to a Censored Region
    Knowledgebase > Technical > Troubleshooting > Connection > Connecting to a Censored Region Connecting to a Censored Region Kaneesha D. - 2021-05-14 - Connection While Our VPN service is available for nearly all regions worldwide. There are a few regions that are known to aggressively block or restrict VPN activity making it difficult to connect. These known regions are: Turkey China Egypt UAE Turkmenistan Kazakhstan Sri Lanka Russia While we are aware that these blocks and restrictions make it difficult to connect, we are able to provide possible workarounds, for users, that allows you to connect to specific regions using our newly implemented Geo-location Regions or with the options to connect via configuration files that connect through an IP address instead of the hostname via OpenVPN. Additionally, it may be possible to establish a connection using other VPN Protocols. For users that are experiencing issues with connecting to the above-listed regions through our newly implemented Geo-located regions please review the following possible workarounds. WireGuard: The First option that users can try, is to change the connection protocol that your application is connecting over to WireGuard. In order to change your application connection protocol please access your applications Settings and navigate to the connection tab within your Desktop application and select the protocol WireGuard. From there you will be able to connect to your desired server location. OpenVPN Connect: The second option that users can try is, setting up an OpenVPN Connection through the OpenVPN Application. The OpenVPN application is a free, open-source application developed by the OpenVPN project. The OpenVPN Project is the same team that develops the OpenVPN protocol, the encryption protocol used at the core of most modern commercial VPN services.
    [Show full text]
  • Openvpn Usage and Certificate Generation Instructions
    OpenVPN Usage and Certificate Generation Instructions Version: <2.0> Release date: <2020-03-30> Contents Contents..............................................................................................................................................2 1 Introduction to OpenVPN..........................................................................................................3 1.1 Overview.............................................................................................................................3 2 Server Installation and Configuration.........................................................................................4 2.1 Deploying the OpenVPN Server on Ubuntu...................................................................... 4 2.1.1 Installing the OpenVPN Server................................................................................ 4 2.2 Starting the Server.............................................................................................................. 5 2.3 Deploying the OpenVPN Server on Windows................................................................... 5 2.3.1 Installing the OpenVPN Server................................................................................ 5 2.3.2 Generating Certificates............................................................................................. 5 2.3.3 Starting the Server.....................................................................................................6 2.4 Server Configuration...........................................................................................................6
    [Show full text]