Users Bypassing Meraki Splash Page

[CDCollins]

Users are able to bypass the splash page using a VPN. I messed around with the VPN myself and managed to get by and have zero restrictions. I have a testing SSID where I created a firewall blocking every IP besides the ones necessary, yet the VPN still managed to bypass the splash page and pull an IP that was denied. Just wanted to see if anyone had a similar issue or any ideas on how to resolve such a massive security problem.

Any help would be much appreciated. Thank you.

[alemabrahao]

Are you sure that the Controller disconnection behavior is not set to Open?

[CDCollins]

@alemabrahao Thanks for the reply. But the Controller disconnection behavior is set to "Restricted."

[alemabrahao]

Can you share your SSID configuration?

[CDCollins]

[alemabrahao]

Try enabling the Walled Garden.

[CDCollins]

Sadly, that didn't work.

[alemabrahao]

I suggest you open a support case.

[CDCollins]

Sweet I'll work on that. I appreciate your quick responses.

[alemabrahao]

This could be a possible workaround.

Workaround: Apply a traffic shaping rule to limit bandwidth on port 53 and other ports that might be used by a VPN. Users attempting to bypass splash pages to access the internet over VPN will not likely use your network if they only get 100 Kbps.

Real Solution: Use an upstream MX or other firewall to block VPN attempts on port 53. Make sure not to block your DNS server such as 8.8.8.8.

Root Cause:
When client devices connect to the MR they are placed in a captive portal policy and the MR firewall rules (L3 and L7) do not get applied to the client devices until after they authenticate with the captive portal. However the traffic shaping rules are indeed applied to clients, and you can limit the throughput of VPN traffic.

https://community.meraki.com/t5/Wireless/Bypass-Meraki-Splash-pages-in-10-secs-to-gain-unrestricted/...

[CDCollins]

For the workaround, is there a way to slow down the bandwidth for specific ports rather than the entire network?

[alemabrahao]

Yes, it is.

[ecejhe]

Thanks mate! It works!

These users were using 3rd party VPN to bypass the guest wireless authentication are now blocked.

[ww]

Capative portal strength also set to block all access?

[CDCollins]

Yes it is.

[WalterBajana]

Unfortunately Splash page is not secure.