【Typical Case】How to do if Reyee RG-EG users use VPN software to bypass captive portal authentication？

Keywords:

Captive portal, VPN, authentication
Issue Description

The RG-EG device is enabled with the captive portal feature on Ruijie Cloud. However, some users can bypass authentication and access the Internet by installing and enabling VPN software, such as Thunder VPN, Nord VPN, Psiphon,and Secure VPN.
Fault test:

Device Model and Firmware

Device Type	Device Model	Firmware Version
Reyee  EG	RG-EG105G-V3	ReyeeOS  2.300.0.2114

Analysis Process

A large number of DNS packets with the source and destination port numbers being 53 are obtained, indicating that the VPN traffic is disguised as DNS packets for Internet access.

Solution

Configure an access control list (ACL) on the gateway to restrict the access from specific DNS addresses and ports. The deployment is as follows:
Ruijie EG Related Configuration
1. Check the DNS on EG, both the EG DNS settings and the DNS in the DHCP settings, then record all of the DNS server’s IP.

2. Add the ACL and apply to the EG LAN, if there have the aggregation interface, apply to the AG interface

3. Set all the DNS UDP 53 port as permit

4. Set the UDP 53 port, TCP 53 port, TCP 67 port as deny

5. Set the any IP protocol with any IP

6. Apply the ACL to LAN interface (if havesub-interface), both inbound and out bound

Reyee EG Related Configuration
1. Check the DNS setting for Reyee EG itself, and DNS in DHCP for Lan Port.Record the mall for the upcoming step.

2.Enter Behavior -- Access Control, add new ACL rules.

3. As is shown below, ALLOW any address to access the Reyee EG DNS recorded before, and DENY these ports: udp 53, tcp 53, tcp 67
  All rules is applied to LAN ports