Hi everyone,
I’m currently facing some frustrating restrictions with the public Wi-Fi at my school. It’s an open Wi-Fi network without a password, but the school has implemented a firewall (Fortinet) that blocks access to certain websites and services, including VPNs like Mullvad and ProtonVPN. This makes it difficult for me to maintain my privacy online, especially since I don’t want the school to monitor me excessively.
After uninstalling Mullvad, I tried to download it again, but I found that even a search engine (Startpage) is blocked, which is incredibly frustrating! Here’s what happened:
- The Wi-Fi stopped working when I had the VPN enabled.
- I disabled the VPN, but still couldn’t connect.
- I forgot the Wi-Fi network and reset the driver, but still no luck.
- I uninstalled the Mullvad, and then the Wi-Fi worked again.
- I tried to access Startpage to search for an up-to-date package for Mullvad, but it was blocked.
- I used my phone to get the software file and sent it over, but couldn’t connect.
- I searched for different VPNs using DuckDuckGo, but the whole site was blocked.
- I tried searching for Mullvad, but that was blocked too.
- I attempted to use Tor with various bridges, but couldn’t connect for some unknown reason.
- I finally settled for Onionfruit Connect, but it doesn’t have a kill switch, which makes me uneasy.
Ironically, websites that could be considered harmful, like adult content, gambling sites and online gaming sites, are still accessible, while privacy-tools are blocked.
I’m looking for advice on how to bypass these firewall restrictions while ensuring my online safety and privacy. Any suggestions or alternative methods would be greatly appreciated! (If any advice is something about Linux, it could be a Problem, since my school enforces Windows 11 only PC’s which is really really igngamblingThanks in advance for your help
edit: did some formatting
edit2: It is my device, which I own and bought with my own money. I also have gotten in trouble for connecting to tor and searching for tor, but I stated that I only used it to protect my privacy. Honestly I will do everything to protect my privacy so I don’t care if I will get in trouble.
edit 3: Thanks for the suggestions, if I haven’t responded yet, that’s because I don’t know what will happen.
You’ll need to download the client off-network (have you tried the local library for that?) and put it on your PC. If you know how to use docker, you could set up the client via docker and dockerhub which I doubt is blocked, but you’d need to set docker up on windows which I have no experience with.
You can also try wireguard on a non-standard port if there are further blocks. OVPN can also go over 443 which might help.
Really though, it depends on how they’re blocking them. They could be blocking the protocol based on port or deep packet inspection, or they could just be blocking a list of VPN hosts. They could be doing both.
If they’re just blocking hosts, you could set up a vpn relay on a host somewhere else, but that won’t help if they’re blocking the protocol.
You’re going to get in trouble and it’s not worth it.
Don’t do personal stuff on their network. What are you even trying to look at via the school network?
If you’re concerned about privacy while doing school stuff, use another device, or maybe a VM. Do they provide computers for students?
You might get off with a warning because you’re young (I assume you’re like 16), but bypassing network security stuff as an adult at work will often get you fired.
I beg to differ. Everyone should have a right to access a free Internet. The censorship they are taking about is so broad that it cannot be accepted. In France the school could get highly punished if they dared to make comments on their harmless Internet activity
The rights everyone should have is irrelevant to the reality. You can’t steal a sandwich and be like “everyone should have the right to food!”. I mean you can, but you’ll still be punished.
Is this the hill for this kid to die on? Probably not. If they were trying to change the system for everyone to be more just, maybe.
You will not be punished for stealing a sandwich where I live. The judge would laugh at the plaintiff
That’s not the point? The school provides a service and is (probably) not obliged to do so. If the school sets rules on this services, it’s OPs choice to either use or not use that service. 🤔
Shall we be content to obey them, or shall we endeavor to amend them, and obey them until we have succeeded, or shall we transgress them at once?
Noli equi dentes inspicere donati.
If this is public school and you are a citizen, you should
Sounds like DNS blocking. Use DoH, won’t be as good as a VPN but it will stop the sniffing which allows them to block domains
Whats DoH? Department of health?
DNS over HTTPS
Airvpn, then use their advanced config to create a 443 tcp tunnel out to a single server. Then use that server’s IP in your OpenVPN config file. Route all traffic including dns inside the tunnel.
Traffic will look like all other web traffic - encrypted on standard web ports. You won’t even need to do a DNS lookup to start with and airvpn uses generic rDNS so it’s not super easy to figure out from their perspective.
Don’t use the WiFi if you don’t like the rules
Thank you, Supernintendo Chalmers
Please read Charger8283’s reply. It’s the best one. You’re thinking small, how do I break out of their system, that will only land you in trouble. You should think big like how Charger8283 thought and break the system altogether.
If you first find vulnerabilities and report them to your school, later when you find another one you don’t tell them about it until they ask. Keep it a secret and use it for a while. Just pretend like you weren’t ready to tell them because you didn’t understand it yet.
Sometimes it pays off to play nice and stupid.
Well it certainly would be cool to break the system but I honestly don’t have the skills for that. I don’t even know how I could possibly do that.
Yeah you already do. I’m assuming that you’re in a public highschool. This advice becomes bad advice when there is any money on “the table”. NEVER do this at a university, private, chartered school, and absolutely NEVER do this to the person who will be giving you a paycheck.
I’ll repeat this to be clear to everyone reading this. Do not do anything on a computer or network someone else owns that they don’t allow when money you have, or money you could have gotten could be taken away.
When I said break the system I didn’t mean become so smart at computers that you can just walk past any barrier in any code. That’s impossible. Breaking the system means learning to understand the people who enforce it and working with them to get yourself around it. It means talking to the IT person, getting them to like you, then getting them to show you how to get around a firewall or tunnel out of a network or at least letting you try without getting into huge trouble.
Here are some good rule of thumbs for work and schools:
-
do not connect to their networks with your personal devices, ever.
-
Only use work/ school devices on their own network.
-
Do not do anything personal on those networks. only do work/school related tasks. This means don’t log into any non school/work accounts.
-
If for some reason they don’t have a device for you but require you to use their network, then leave your personal devices at home claiming you don’t own one and make them accommodate you.
You cannot expect privacy in these situations, and by going to the extreme lengths to try to get it then you will ironically just paint a bigger target on your back if any network admin cares. In some cases this can cost you your job or get you in trouble with the school.
-
I’m aware of a network that blocks Mullvad as well, but found a way around it. It went through just fine if I was using a custom DNS server. I used NextDNS for this, but I imagine it would work with Cloudflare or something as well (but I highly recommend NextDNS anyways). Hope this helps!
Seems like Tor snowflake is a proxy that makes your internet traffic appear as a video call. Its purpose is to circumvent censorship, but it may get around firewalls as well. I have no experience bypassing firewalls using snowflake, but it may be a viable option (someone correct me if I’m wrong) https://snowflake.torproject.org/
Don’t use the school’s wi-fi? I’m sure there are other options to you.
Obligatory “read your schools’ computer use policy before you get yourself in trouble for evading the firewall”
Yeah, you probably don’t want to risk getting caught for that. There is a possibility you could be criminally charged (regardless of how stupid you might think that is, it happens) when the school finds out what you’re doing. And if you’re using school-issued hardware they’re very likely to find out what you’re doing.
I don’t know where to find the policy regarding the network. The computer isn’t school property, I own it which is more frustrating because I have to uninstall (Just disabeling it and the Killswitch won’t work) any VPN to start using the network.
It might be your computer, but it’s their network - they get to set the rules as to how it gets used.
Ask for it especially if you are getting in trouble
Typically, using your own VPN should suffice. Depending on your situation you can do other things as well. If you are unable to download these tools on the school network in question; do not attempt to do so again. Use a public or other network connection elsewhere to obtain the tools you need to bypass their crap.
For example, NextDNS could be helpful. By running their client app; ( https://github.com/nextdns/nextdns/wiki/Windows ) you can make sure all your DNS requests are encrypted. Similarly you could simply set up a local DNS server that you point Windows at which can redirect those requests over DNS-Over-(HTTPS or TLS) to a DNS provider of your choosing.
If it’s any school like mine was, where people actively look at all the traffic going through their network, it’s a losing battle. And I say this as both a huge privacy advocate and a long-time network engineer.
Anything even remotely resembling a tunnel, VPN or proxy is going to make you stand out in their monitoring, because they will see constant traffic between you and the same host on the other end… traffic that practically never stops. In my day the school even force-reset SSH and RDP sessions after a while (or maybe it was actually ALL tcp sessions, not sure).
It doesn’t matter what protocol or technique you use at that point because they can either block whatever IP/ports you use, every time you change it, or threaten/shut off your service.
i2p would stand
There are tools that can reasonably get around that technically. You just need to make it look like https traffic.
I say this as it is possible to bypass the great firewall in China which was likely build on a much bigger budget
too much https traffic could also look suspicious, which they could then block…
It wouldn’t be that much traffic. It would just be https going to random IPs which looks like regular browsing. If you start blocking thing you will create lots and lots of issues plus angry users.
I also doubt they have some guy watching every connection for an entire school.
I’m assuming you probably have a smartphone. In which case, I would just use your Wi-Fi hotspot instead.
Which means the mobile data plan, which doesn’t sound that easy anymore. Where I live (EU) mobile data plans are either quite limited in data cap or expensive, and for a lot of years now they are just shutting it down when yours ran out, instead of slowing it down.
I tried this but my signal isn’t strong enough to get thorugh the walls. In some classrooms it works, but it’s more like a 50/50 chance to stay connected.
Why does it need to go though walls?
Also if the signal is a problem just use a physical cable
Physical cable to the nearest cell tower?
What? WiFi doesn’t use a tower. Your phone is the access point.
Yeah, fair enough
There is a way, it’s called SSH over HTTP, I think there are many guides on the internet. I hope this works.
EDIT: I don’t know how to do that on Windows or if it’s possible but maybe with a virtual machine… sorry.
