I'm trying to prevent devices on my network from using VPN services through an Arris router. I tested custom firewall rules blocking TCP ports 80 and 443, but VPN connections still worked, and I'd like regular web browsing and other internet services to continue normally. Is there a reliable way to do this on the router, or is completely blocking VPNs impractical?
3 Answers
DNS filtering services such as NextDNS or Control D may be easier to configure than individual firewall rules. They can block known VPN domains and endpoints while allowing ordinary browsing, although they still won’t catch every VPN and may require a subscription depending on the service and usage level.
A complete block is difficult because VPN traffic can use common ports, especially TCP 443, and can be made to look like regular encrypted web traffic. Blocking provider IP ranges or known VPN domains may reduce casual use, but those lists change and can accidentally block legitimate services. For stronger control, a router or firewall with application-level traffic inspection and device-specific policies would work better than basic Arris port rules.
Blocking ports 80 and 443 usually won’t help because those are normal web ports, and many VPNs can use them or disguise their traffic as ordinary HTTPS. You could block common VPN protocols and ports—such as PPTP, L2TP, IPsec, and WireGuard—and disable VPN passthrough if the router offers that option. However, this will mostly stop basic VPN setups, not a determined user with a modern client.
Are those services free, or would I need a paid plan to use the VPN-blocking features?