bypass FortiGuard firewall

[scropion86]

hi,

i have tried every possible setting but not able to bypass FortiGuard firewall.
if anybody know what could be the correct settings please comment on this issue.

thanks

[krlvm]

If it is filtering by IP you can only bypass it using encrypted connection (VPN, TOR), otherwise try enabling SNI modification.

[scropion86]

i am not sure how it is actually works but even in most VPN client used in this network the client can't establish the connection at all nether from windows or with android.

[Saya47]

Hello.
When I ping an IP address of a specific blocked website, I get "Request Timed Out".
But when I connect to a VPN or use TOR, I can ping the IP address successfully.
Does that mean my ISP has blocked that website by IP address and I can't bypass the censorship with PowerTunnel?
Thanks very much.

[scropion86]

the websites or servers which i was trying to access is allowed by the ISP and not blocked nationally
but the network admin is blocking it which i was not able to bypass with PowerTunnel

for example

and i can ping

C:\Users\USERNAME>ping battle.net

Pinging battle.net [137.221.106.104] with 32 bytes of data:
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49

Ping statistics for 137.221.106.104:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 197ms, Maximum = 197ms, Average = 197ms

also trace the domain

C:\Users\USERNAME>tracert battle.net

Tracing route to battle.net [137.221.106.104]
over a maximum of 30 hops:

  1     *        *        *     Request timed out.
  2     2 ms     1 ms     1 ms  #############################
  3     *        *        *     Request timed out.
  4     1 ms     3 ms     2 ms #############################
  5     2 ms     1 ms     2 ms  #############################
  6     3 ms     4 ms     2 ms  #############################
  7     *        *        *     Request timed out.
  8     3 ms     2 ms     2 ms  #############################
  9     3 ms     3 ms     3 ms  #############################
 10    49 ms    64 ms    53 ms  #############################
 11     *        *        *     Request timed out.
 12   157 ms   154 ms   154 ms  blizzard-en.ear7.chicago2.level3.net [4.7.196.134]
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15   197 ms   197 ms   196 ms  et-0-0-0-pe04-swlv10.as57976.net [137.221.83.87]
 16   198 ms   197 ms   197 ms  las-swlv10-ia-bons-04.as57976.net [137.221.66.23]
 17   197 ms   196 ms   197 ms  137.221.105.15
 18   197 ms   196 ms   197 ms  137.221.106.104

Trace complete.

[krlvm]

Hello.
When I ping an IP address of a specific blocked website, I get "Request Timed Out".
But when I connect to a VPN or use TOR, I can ping the IP address successfully.
Does that mean my ISP has blocked that website by IP address and I can't bypass the censorship with PowerTunnel?
Thanks very much.

Yes, you need to use encrypted connection because your ISP banned the resource by IP address, not by name (e.g. you can bypass "github.com" ban, but not "140.82.121.4" (GitHub IP) ban, because the URL resolves into IP address and ISP sees real destination anyway.

[krlvm]

the websites or servers which i was trying to access is allowed by the ISP and not blocked nationally
but the network admin is blocking it which i was not able to bypass with PowerTunnel

for example

and i can ping

C:\Users\USERNAME>ping battle.net

Pinging battle.net [137.221.106.104] with 32 bytes of data:
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49
Reply from 137.221.106.104: bytes=32 time=197ms TTL=49

Ping statistics for 137.221.106.104:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 197ms, Maximum = 197ms, Average = 197ms

also trace the domain

C:\Users\USERNAME>tracert battle.net

Tracing route to battle.net [137.221.106.104]
over a maximum of 30 hops:

  1     *        *        *     Request timed out.
  2     2 ms     1 ms     1 ms  #############################
  3     *        *        *     Request timed out.
  4     1 ms     3 ms     2 ms #############################
  5     2 ms     1 ms     2 ms  #############################
  6     3 ms     4 ms     2 ms  #############################
  7     *        *        *     Request timed out.
  8     3 ms     2 ms     2 ms  #############################
  9     3 ms     3 ms     3 ms  #############################
 10    49 ms    64 ms    53 ms  #############################
 11     *        *        *     Request timed out.
 12   157 ms   154 ms   154 ms  blizzard-en.ear7.chicago2.level3.net [4.7.196.134]
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15   197 ms   197 ms   196 ms  et-0-0-0-pe04-swlv10.as57976.net [137.221.83.87]
 16   198 ms   197 ms   197 ms  las-swlv10-ia-bons-04.as57976.net [137.221.66.23]
 17   197 ms   196 ms   197 ms  137.221.105.15
 18   197 ms   196 ms   197 ms  137.221.106.104

Trace complete.

Google says FortiGuard uses DNS-based filtering, so you try changing your DNS server either in PowerTunnel settings, either in your system settings, but looks like it uses another filtration method (137.221.106.104 is battle.net IP indeed). You can try increasing fragment (chunk) size. You can also try to enable SNI modification, but make sure that you don't have kind of FortiGuard certificates installed.

[scropion86]

i have tried all the suggested tricks , and even SNI but the problem it is not blocking the website and show as invalid certificate
it just show the blocking page result of FortiGuard.
it looks like it uses DPI blocking mechanism

[krlvm]

show as invalid certificate

I think you missed this step

[scropion86]

no i have gone through all this guide , but with no success