How to block browser-based VPN/proxy extensions (ex: Browsec) 100

Made Slimacek Lv1Posted Oct-30-2025 16:54

Hi,

I'm using Athena/IAG 13.0.62 R2 which was Bridge mode.
We are facing issue with blocking browser based VPN or Proxy extension, our rule is already enabled to block AllProxy Tools, HTTP_PROXY and All Proxy detection.

Already open the ticket with Local ID Support, and the answer is Sangfor Not Support to block Proxy extension.

My question is,
Any other method to block Proxy extension / block from network level, with feature on IAG?


Thanks,

By solving this question, you may help 631 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins, 100 coins of bounty and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

net_specialist Lv1Posted Nov-11-2025 13:14
  
Options to Block Proxy Extensions at Network Level


1. Enable SSL/TLS Decryption (Gateway or Client Mode)

Most browser VPN extensions use HTTPS tunnels. Without SSL inspection, their traffic looks like normal HTTPS.
IAG supports Gateway SSL Decryption and Client SSL Decryption to inspect encrypted traffic. Once enabled, you can apply URL filtering and application signatures to block known proxy/VPN services.
Caveat: Requires deploying certificates to endpoints and may impact performance.



2. Use Application Control + Proxy Avoidance Protection

Sangfor offers Proxy Avoidance Protection as part of its Application Control and XDDR framework.
This works best when IAG is integrated with Sangfor Endpoint Secure:

Endpoint Secure reports installed applications (including VPN/proxy tools).
IAG enforces Application Containment policies to block or monitor these apps.


This is currently the most effective method for blocking anti-proxy tools and VPNs at both endpoint and network levels. [sangfor.com], [sangforcloud.ae], [sangfor.com]



3. Dynamic URL Filtering

Many proxy extensions rely on specific domains or IP ranges.
Use IAG’s URL Category Filtering to block:

“Proxy Avoidance” category
Known VPN/proxy domains (Sangfor maintains an updated signature database).


Combine with real-time updates from Sangfor’s cloud signature service.



4. Traffic Behavior Analysis

Enable Intelligent Traffic Management:

Detect abnormal traffic patterns (e.g., high TLS handshake frequency, non-standard ports).
Apply bandwidth throttling or block rules for suspicious sessions.





5. Custom Block Lists

If you identify specific IPs or domains used by extensions, add them to Blacklist in IAG.
This is manual and reactive but can help for known problematic services.




❌ What Won’t Work

Purely relying on HTTP Proxy detection or AllProxy Tools rules → These do not catch browser extensions because they often use HTTPS over standard ports.
Blocking by User-Agent → Extensions usually mimic normal browser traffic.


Best Practice

Combine SSL Decryption + URL Filtering + Endpoint Secure integration for full coverage.
If Endpoint Secure is not deployed, focus on SSL inspection and category-based filtering.

I Can Help:

Change

Moderator on This Board

908
182
94

Started Topics

Followers

Follow

Board Leaders