Denied OpenVPN connection still transferring data

Hi Wilbur,

Thank you for reaching out to Sophos Community.

Kindly try to follow the KB below for blocking of OpenVPN

 Sophos Firewall : Application filter recommended settings for better application detection 

That's what I did to block OpenVPN, via the Application filter policy...

Hi Wilbur,

How about the other settings stated in the KB?

 Sophos Firewall : Application filter recommended settings for better application detection 

Only missing the maxpkts 80... it was at 8. I just changed it and will see tomorrow if that makes a difference.

Thank you.

Hi Wilbur,

Please do update us. Thank you

Application control does not work on packet 1 and needs some more time to understand, which application it could be.

And also, application control on a firewall level could be tricky, if the app is trying to hide what it does. VPNs tend to do this (destination port is not sufficient to assume, what it is). The traffic is encrypted, so it can be hard to assume something.

Therefore application control on the endpoint is much more clearer and a better approach to stop apps in the first place. Even if you stop traffic, the app is still there and running. 

That seems to work, as I don't see that anymore.  I'll revisit if it shows up again.

Thank you for your help.

That's a good suggestion, I'll look into this.

Thank you.