VPN Detection & Blocking

Overview

KyberGate detects and blocks VPN usage on managed devices. When a student attempts to use a VPN to bypass web filtering, KyberGate identifies the VPN traffic pattern, blocks the connection, and logs the attempt. Admins can view VPN attempt statistics including top services, top users, and attempt counts.

VPN detection works at the proxy level by identifying known VPN protocols, IP ranges, and traffic signatures.

Prerequisites

• KyberGate organization with proxy filtering active (Proxy v32+)
• Managed devices configured to route through the KyberGate proxy
• Admin access to the KyberGate dashboard

How It Works

KyberGate uses multiple detection methods:

1. Known VPN Domains — maintains a database of 500+ VPN service domains (NordVPN, ExpressVPN, Surfshark, etc.) and blocks access to their sign-up, download, and connection endpoints
2. VPN Protocol Detection — identifies OpenVPN, WireGuard, IKEv2/IPSec, and SSTP protocol signatures in traffic
3. IP Range Blocking — blocks connections to known VPN server IP ranges published by commercial VPN providers
4. Browser Extension Detection — the Chrome extension detects and reports installed VPN extensions
5. Traffic Pattern Analysis — identifies anomalous encrypted tunnel traffic that may indicate unknown or custom VPN usage

Steps

Step 1: Verify VPN Blocking Is Enabled

Log in to the dashboard → Settings → Filtering → VPN Detection. Confirm the toggle shows Enabled.

VPN blocking is enabled by default for all KyberGate organizations.

Step 2: Review VPN Attempt Stats

Navigate to Reports → VPN Detection to see:

• Total VPN Attempts — count of blocked VPN connections over the selected time period
• Top VPN Services — which VPN services students are trying to use (ranked by attempt count)
• Top Users — which students have the most VPN attempts
• Attempt Trend — daily/weekly graph showing VPN attempt patterns
• Detection Method — breakdown by how VPN traffic was detected (domain block, protocol, IP range, extension)

Step 3: Investigate Individual Attempts

Click on any student in the Top Users list to see their VPN attempt history, including timestamps, VPN service attempted, detection method, and device used.

Step 4: Configure Alerts

Under Settings → Alerts → VPN Attempts, configure notifications:

• Email alert on first attempt — notify when a student tries a VPN for the first time
• Email alert on repeated attempts — notify when a student exceeds N attempts (configurable threshold)
• Daily digest — summary of all VPN attempts in the past 24 hours

Step 5: Whitelist Legitimate VPNs (Rare)

If your school uses a VPN for legitimate purposes (e.g., district-wide VPN for staff remote access):

1. Go to Settings → Filtering → VPN Detection → Whitelist
2. Add the VPN service domain or IP range
3. Select which user groups can use it (typically staff only)
4. Save

Common VPN Services Detected

KyberGate detects and blocks all major VPN services, including:

• NordVPN, ExpressVPN, Surfshark, CyberGhost, Private Internet Access
• ProtonVPN, Windscribe, Hotspot Shield, TunnelBear, Hide.me
• Free VPN extensions: Hola, ZenMate, Browsec, SetupVPN, TouchVPN
• Custom/self-hosted VPNs (detected via protocol analysis)
• SSH tunnels and SOCKS proxies used as VPN alternatives

Tips

• VPN attempt reports are useful during conversations with students and parents about digital citizenship
• High VPN attempt counts from a specific student may indicate they are actively trying to bypass filtering — follow up with your school's acceptable use policy
• On supervised/managed devices, VPN apps cannot be installed without MDM approval. VPN blocking is a second layer for browser-based VPN extensions and web-based VPN services.
• Review VPN stats monthly and share trends with your admin team
• The Chrome extension blocks installation of known VPN extensions proactively, before they can even connect

FAQ

Q: Can KyberGate detect ALL VPNs? A: KyberGate detects all major commercial VPNs, free VPN extensions, and common protocols (OpenVPN, WireGuard, IPSec). Highly custom or obscure VPN setups may evade detection, but the proxy-based architecture makes bypassing very difficult.

Q: Does VPN detection slow down internet for students? A: No. Detection happens as part of the normal proxy traffic flow. There is no additional latency.

Q: What about VPN usage at home? A: VPN detection works whenever the device routes through KyberGate's proxy. If a student disconnects from the proxy at home (fail-open mode), VPN detection does not apply. For persistent enforcement, use the Chrome extension which reports VPN extension usage regardless of proxy status.

Q: Will this block school-issued VPN access for remote teachers? A: Only if the VPN service isn't whitelisted. Add your school's VPN service to the whitelist for staff/teacher groups.

Q: How quickly is a new VPN service added to the detection list? A: KyberGate updates its VPN database weekly. If students discover a new VPN that isn't detected, report it to support@kybergate.com and it will be added within 48 hours.