VPN and Proxy Domains List: Block the Tools That Bypass Your Filter
Every web filter has the same weak spot. One working VPN or web proxy, and every other rule on the network stops mattering for that user.
This page explains what a VPN and proxy domains list covers, how fast it changes, and the extra network controls that close the gaps a domain list cannot reach alone.
The bypass, and where the list cuts it
What is in the VPN and proxy domains list
The list is the VPN / Proxy / Anonymizers category of the 59-category taxonomy. It covers services whose main purpose is hiding where traffic goes or who sends it.
Commercial VPNs
Websites of paid and free VPN providers, where people sign up and download apps.
VPN app back ends
Account, configuration and server list hosts that apps contact by name, where identifiable.
Web proxies
Sites that load another site inside their own page. The most common school bypass, because they need no install at all.
Proxy lists
Sites that publish fresh proxy addresses and mirrors, acting as a map around the filter.
Tor-related sites
Download, bridge distribution and gateway sites for the Tor network, which is built to hide traffic.
Smart DNS services
Services that reroute lookups to change apparent location, often sold for streaming.
Browser-in-browser tools
Hosted browsers whose main use is getting around network controls.
Mixed services
Tools with a proxy feature next to another purpose carry both categories, ranked.
The category page covers the data side: see VPN and proxy domains. We do not name proxy or bypass sites on this page.
In the list, and kept out of it
A bypass list has to be strict about what counts as a bypass. Blocking business remote access by mistake does far more damage than one missed proxy.
In the list
- Consumer VPN providers and their app hosts
- Free and paid web proxy sites
- Anonymizer and IP-hiding services
- Proxy list and mirror directories
- Tor download and bridge distribution sites
Kept out of it
- Your own company VPN gateway and single sign-on
- Remote desktop and support tools, in Remote Access Tools
- Content delivery networks, in CDN / Hosting / Infrastructure
- News and reviews about privacy, in News/Media or Computers & Technology
- Security vendors' corporate sites, in Business
Remote access tools are a separate decision with their own list: see how to block remote access tools. Many networks block both, but for different reasons: bypass on one side, support scams and unmanaged access on the other.
Why a domain list is one layer, not the whole answer
VPN apps are built to resist blocking. The domain list stops most attempts early, but an app already installed may never look up a name you can block.
Domain list
Stops sign-ups, downloads, web proxies and apps that look up servers by name.
DNS control
Force all DNS through your resolver and block outside and encrypted DNS.
Firewall rules
Block common VPN protocols and ports from user segments.
App control
Use your firewall's application identification for VPN traffic on port 443.
Devices
Use MDM to block VPN app installs and VPN profiles on managed devices.
Most bypass attempts in schools are web proxies and freshly installed VPN apps. Layers 1 and 2 stop most of them. Layers 3 to 5 deal with the determined few.
Built-in privacy features to plan for
Some bypass routes are not VPN products at all but features of browsers and phones. These well-documented signals let a network say that filtering applies.
| Feature | What it does | Network signal | Notes |
|---|---|---|---|
| Browser encrypted DNS | Sends lookups to an outside resolver over HTTPS | Return a negative answer for use-application-dns.net | Firefox checks this canary domain for users whose encrypted DNS was turned on by default |
| iCloud Private Relay | Routes Safari traffic through relay servers | Return NXDOMAIN or no answer for mask.icloud.com and mask-h2.icloud.com | Apple documents this approach; check its current guidance for any extra hostnames |
| Outside DNS servers | Devices set to a public resolver skip yours | Block outbound port 53 except from your resolvers | Also block known encrypted DNS endpoints on 853 and 443 where possible |
| Managed devices | Users can change settings unless prevented | MDM restrictions on VPN profiles and relay features | The most reliable control on school and company devices |
Step by step instructions are in how to block VPN apps, how to block proxy sites and how to block Tor.
How big the list is and how fast it changes
The VPN / Proxy / Anonymizers category has a stable core and a fast-moving edge. The core is the commercial VPN brands. The edge is free web proxies, which come and go constantly.
Stable core
Commercial VPN providers change domains rarely. Their entries stay valid for long periods, though new brands and white-label resellers keep appearing.
Fast edge
Free proxies re-register under new names as soon as old ones are blocked, often in batches.
Daily deltas
About 300,000 newly registered domains are categorized each day, so new proxies reach the list quickly.
Rechecks
New domains are checked again after a week and a month, catching proxies that launch with a blank page.
Exact counts change daily and are shared with licence holders. For a sense of why speed matters here, see blocking newly registered domains, which closes the gap before a new proxy is categorized.
Formats for the VPN and proxy list
The list ships in the same formats as every category. The blocklist formats guide shows each one; these are the ones most bypass policies use.
DNS RPZ
For resolvers, with block pages and passthru exceptions.
Firewall EDL
For URL and domain rules next to your VPN protocol rules.
Adblock style and hosts
For small DNS boxes and kids' devices.
CSV, Parquet, JSON
For filtering products and parental control apps.
How to deploy a VPN and proxy blocklist
Order matters. Load the list first, close DNS bypass second, and only then tighten firewall rules, so you can see what each step changes.
Allow your own remote access first
Put your company VPN gateway, single sign-on and remote support tools on an allow list before anything else.
Load the category on the resolver
Use a block page that explains the rule. Students and staff who see a reason are less likely to keep trying.
Force DNS through your resolver
Block outbound DNS from user segments and add the encrypted DNS and relay signals shown above.
Add firewall protocol rules
Block common VPN protocols from user segments, for example the OpenVPN default port 1194 and the WireGuard port many setups use, 51820.
Use application identification
Many VPN apps fall back to port 443. Application control features catch that traffic where your firewall supports it.
Lock down managed devices
Block VPN app installs and VPN profiles with MDM. On school devices this is the control that holds when everything else fails.
Watch the logs
A rise in blocked proxy lookups after a new block often means students are hunting for a way around it.
Schools should read K-12 school web filtering, and US schools the CIPA web filtering overview, since a filter that can be bypassed easily is hard to defend.
VPN and proxy policy by environment
Almost everyone blocks web proxies. VPN services are a closer call outside schools, because some staff and guests have honest reasons to use them.
| Environment | Web proxies | Consumer VPNs | Tor | Typical exception |
|---|---|---|---|---|
| K-12 school | Block | Block | Block | None for students |
| Library | Block on minors' devices | Local policy | Local policy | Adult patrons, per policy |
| Office | Block | Block on company devices | Block | Security team testing |
| Regulated firm | Block | Block | Block | None without approval |
| Hotel and guest Wi-Fi | Often block | Usually allow | Local policy | Business travellers need their VPN |
| Kids' devices | Block | Block | Block | None |
Guest networks are the main place to leave consumer VPNs open. Business travellers often rely on a VPN to reach their own company, and blocking it there causes more complaints than it prevents risk.
Common mistakes with bypass blocking
Most failed bypass policies fail for the same few reasons. Each one is quick to avoid once you know it.
DNS left open
The list is loaded, but devices can still use any public resolver, so the list is skipped in one setting change.
Own VPN not allowed
A strict rule cuts off remote staff on a Monday morning. Allow your gateway before anything else.
Static list
A proxy list loaded once is out of date within days, because new proxies appear constantly.
Silent blocks
No block page means users keep trying new tools. A clear message ends most attempts.
False positives and shared domains
A few services sit awkwardly on the line between privacy tool and everyday service. Decide on them before rollout so the help desk has an answer ready.
Shared brand domains
Some privacy companies run mail, calendar and VPN on one domain. Blocking the domain can block mail too; check the hostnames.
Translation and cache tools
Some fetch pages on the user's behalf. Only those whose main use is bypass are in the list.
Developer tunnels
Tools that expose a local app to the internet sit in Developer Tools. Decide on them separately.
Security research
Analysts may need anonymizers. Give their segment a documented exception.
Check a disputed site with the domain lookup to see every category it carries. If it clearly is not a bypass service, allow it locally and report it for review.
Testing your bypass protection
Bypass protection is only as good as the last route someone tried. Test it the way a curious student or a frustrated employee would.
Routes to try
- Search for a free web proxy and open the first few results
- Try to open a VPN provider's sign-up and download pages
- Install a VPN app on a test phone and try to connect on Wi-Fi
- Set a laptop to a public DNS server and browse a blocked site
- Turn on the browser's encrypted DNS and the phone's relay feature
- Try the Tor Browser download page and a bridge request
What a pass looks like
- Proxy and VPN sites show your block page with the category name
- The test VPN app fails to connect or cannot fetch its server list
- Lookups to outside DNS servers are refused at the firewall
- The phone reports that the relay is not available on this network
- Your company VPN and remote support tools still connect normally
- Every attempt shows up in your logs with the device name
Repeat the test each term or quarter. New VPN apps and proxy techniques appear all the time, and a check that passed in spring may not pass in autumn.
Who builds this list into a product
Bypass protection is a feature customers check first when they compare filtering products. Vendors license the category so the feature keeps working without an in-house research team.
School filter makers
Bypass control is the first thing districts test in a pilot, and the first thing students try.
Parental control apps
Children find VPN apps quickly. See the parental control app database guide.
DNS filtering services
A bypass toggle next to content categories. See DNS filtering integration.
MSPs
One bypass rule across every client, so content policies cannot be skipped.
Embedding the data in a product needs an OEM licence. Licences do not allow resale or publication of the raw list.
VPN and proxy domains list FAQ
What is in a VPN and proxy domains list?
Domains of commercial VPN services, their app download and account hosts, free web proxy sites, proxy list sites and other anonymizers. In our taxonomy they belong to the VPN / Proxy / Anonymizers category.
Can a domain list block VPN apps completely?
Not on its own. The list stops people reaching VPN websites, signing up and downloading apps, and stops apps that look up their servers by name. Apps already installed may connect straight to IP addresses, so add firewall rules and device management.
Why do schools need to block proxy sites?
A single open web proxy lets a student reach every site the filter blocks. Blocking the VPN and proxy category is what keeps the rest of a school's filtering policy meaningful.
Will blocking VPNs break our company VPN?
It should not. Your own VPN gateway is not a consumer VPN service and is not in the list. Add its hostname to your allow list anyway, so a policy change can never cut off remote staff.
How do I stop iCloud Private Relay on my network?
Apple documents that networks can return a negative answer, such as NXDOMAIN, for mask.icloud.com and mask-h2.icloud.com. Devices then show users that Private Relay is turned off for that network. Managed devices can also disable it by policy.
How fast do new proxy sites appear?
Free web proxies are among the fastest changing sites on the web, because operators register new names as soon as old ones are blocked. New domains are categorized daily and rechecked after a week and a month.
Does the list include Tor?
The list covers Tor-related websites such as download and bridge distribution sites. Tor relays are reached by IP address, so blocking the network itself needs firewall rules or an application control feature as well.
Should guest Wi-Fi block VPNs?
Usually not. Business travellers often need a VPN to reach their own company, so blocking consumer VPNs on guest networks causes complaints. Many venues block web proxies and leave VPNs open.
Why are no proxy site names listed on this page?
Publishing working proxy addresses would help people trying to get around filters more than the people running them. Licensed customers receive the full category as files.
How much does a VPN and proxy domains list cost?
The category comes with the categorized database licence. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment.
Close the gap every other list depends on
License the VPN / Proxy / Anonymizers category and 58 others across 120 million domains, with daily new-domain deltas and exports for resolvers, firewalls and apps.
iCloud, iCloud Private Relay and Safari are trademarks of Apple Inc. Firefox is a trademark of the Mozilla Foundation. Tor is a trademark of The Tor Project, Inc. OpenVPN is a trademark of OpenVPN Inc. WireGuard is a registered trademark of Jason A. Donenfeld.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by these companies.