Detecting VPN Activity Using School Manager

A Virtual Private Network (VPN) allows users to hide their identity and access content in different locations. While VPNs have several legitimate purposes, they are commonly used by students to attempt to circumvent school internet filtering. 

If you find students consistently using or trying to use VPNs in a school environment, they are likely trying to bypass your school's content filtering policies and prevent your school from meeting your duty of care.

All users accessing the Statistics and Cyber Safety menus can use School Manager’s User Journey, Red Flags, Search and Blocked Reports to investigate possible VPN use.

User Journey Report and selecting the Proxies and VPNs Category

To view student VPN activity using the User Journey Report:

1. Go to Statistics > Active Users.
2. Search or select the student’s username to open their dashboard.
3. Select User Journey.
4. Select the Proxies and VPNs category from the Filter by Category dropdown.

The User Journey Report shows:

• Timestamp: When the student requested the VPN activity.
• Result: If access to a VPN website, application or search was allowed, blocked or flagged.
• Activity: The VPN website, application or search used by the student.
• Type: If the activity by the student was of Web (opening a website or application) or Search (searching for information on search engines) type.

Using the Red Flags

To view student VPN risk indicators using the Red Flag Report:

1. Go to Cyber Safety > Red Flags.
2. Select the VPN tag from the Select filter tag dropdown.

The Red Flag Report shows:

• Username: The username of the student.
• Full Name: The name of the student.
• Risk Indicator: Displays an App (globe) or Search (magnifying glass) icon with the VPN tag to help you quickly identify the source of the VPN-related activities. The Risk Indicator color lets you know how frequently the student attempted VPN activity.

Using the Search Report

To view student VPN activity using the Search Report:

1. Go to Cyber Safety > Searches.
2. Select the VPN Search tag from the Select filter tag dropdown.

The Search Report shows:

• Username: The username of the student.
• Full Name: The name of the student.
• VPN Search Queries: The number of searches for each student during the selected time period. You can use this to compare students most interested in looking to hide their internet activity or circumvent school content filtering and monitoring.

Using the Blocked Report

To use the Blocked Report to view blocked VPN activity, your school must have an active content filtering policy to block VPNs.

To view blocked student VPN activity using the Blocked Report:

1. Go to Cyber Safety > Blocked.
2. Search for VPN.
   1. Select the Apps view to find applications blocked for a student.
   2. Select the Policies view to find content filtering policies blocked for a student.

Your IT Support can also use their Advanced Search tool to discover hidden or anonymized online traffic and email you the results. You can use the results to create new filtering policies to block new types of activity associated with VPNs.