I'm trying to prevent devices on my network from using VPN services through an Arris router while still allowing regular web browsing and other internet access. I tried creating custom rules to block TCP ports 80 and 443, but VPN usage still worked. Is there a reliable way to do this, and which router settings or services should I look at?
2 Answers
Blocking ports 80 and 443 won’t usually help because those are standard web ports, and many VPNs can use them or disguise their traffic as normal HTTPS. You could try blocking common VPN protocols and ports, such as PPTP, L2TP, IPsec, and WireGuard, if your router supports those firewall rules. However, this will only stop simpler VPN setups; a determined user can often switch protocols, use another port, or use a VPN that blends into regular traffic.
Some routers have a VPN passthrough setting that can be disabled, but that mainly affects certain VPN protocols and may not block every VPN application. In practice, combining DNS filtering with blocks for known VPN endpoints and protocols works better. There is no perfect router-only solution while still allowing unrestricted normal internet access, because advanced VPNs can use ordinary HTTPS traffic or constantly changing servers.
The router’s custom rules only seem to offer basic port and protocol options, so I’m not sure how much of this I can actually configure.