Neeed to refuse the use of Proxy

🍱 Features & apps piwik
1

Hi,

I am using Nextcloud with Matomo. I’ve discovered that if somebody connecting to Nextcloud using a proxy ( like a VPN), matomo doesn"t record anything.
Without the use of a VPN, i have a record.

Is there a way to refuse any connections if the user is going through a VPN ?

I saw this configuration

'trusted_proxies' =>
  array (
    0 => '192.168.103.44',
    2 => '127.0.0.1',
    1 => 'localhost',
    11 => '127.0.0.1',
    12 => '::1',
    13 => 'dbe5e509ecaf',
    14 => '172.18.0.6',
15 =>'79.244.33.204',

),

=> but I need the opposite… I want to stop any VPN / Proxy ( and maybe accept some pre- defined )

how can I do that ?

PS: I had a look via Apache ( httpd.conf) , but nothing really is working…

Thanks and regards,

2

What do you mean by “connected to Nextcloud” specifically? What type of VPN? Where does the VPN terminate?

3

Blocking connections from VPNs is a technically challenging task and may not be foolproof. VPNs are designed to ensure user privacy and security, and attempting to block VPN connections can be considered unethical.

However, there are some measures you can take to make it more difficult for users connecting through VPNs to access your cloud:

  1. Monitor IP Addresses: Keep an eye on the IP addresses accessing your website and create a list of legitimate IP addresses. The downside is that VPN providers often change their IP addresses.
  2. Blacklist VPN IP Addresses: There are public lists of IP addresses used by VPN providers. You could try blacklisting these IP addresses. Keep in mind that this approach might affect legitimate users (false positives).
  3. Deep Packet Inspection (DPI): DPI (like snort) can be used to analyze traffic and detect VPN connections. This requires advanced knowledge and may raise legal concerns.
  4. Honeypots: Set up honeypots or specific pages that attract VPN users. If a request comes from a suspicious IP address, you can block access.

It’s important to note that many users use VPNs for legitimate reasons and it is impossible to detect every VPn connecton.
I host some VPN servers myself that are used to penetrate “the Great Wall of China” and believe me, they have the very best tools for detecting VPNs and even they can’t prevent it.

Much and good luck,
ernolf

4

But it is running on your server, so you should be able to track the ip?

You have do not track features in firefox, that seem to be respected by matomo by default: https://matomo.org/faq/troubleshooting/faq_58/

As far as I understand, there is js code for matomo used on the client side, that could be filtered by a VPN and/or plugins.

I wouldn’t try to force my users a certain way to use the web. Some might have reasons to use a VPN, or they want to block execution of additonal code. If you want a global traffic usage per user or something like that, there might be other less instrusive ways.

1 Like
5

Hi,
In fact, I am using the plugin : Piwik/matomo v 0.12.0
Should I use another way to do it ?

If I connect to the Log, I can see the log… but nothing into matomo

6

Hi Ernolf,
Well… If you see banks, most of them don’t want to use VPN systems… and they refuse you to be connected an your account via VPN. so, it shoud be possible…

Thanks anyway

7

They probably use one or several of the strategies ernolf mentioned in his post.

How do you know that these users have a VPN connection and not only an add blocker (or some privacy extension in their browser that blocks typical statistic js code)?