Firewalling! How can you stop a ssh tunnel?

[JonJ678]

Say you have a computer acting as a gateway to the internet. Someone on the local network has root access to a (his) computer, and to a computer on the other side of the gateway.

You've implemented a cheerfully draconian approach to security. Say a "no porn" or "no pirate bay" stance, in UK Government fashion. Unfortunately for you as the gateway owner, everyone with access to Google has come across VPN and ssh tunnels. How can you restrict traffic despite these?

I'm drawing a blank. Routing http(s) traffic over ssh on whatever port you like is trivial. The next level up is forcing everything through a http proxy, in which case corkscrew or similar efforts route ssh through the proxy.

I think the only option is to plead with the user to obey your policies and try to ignore those who don't. However I'm very much a novice with networking and would like to know whether blocking websites hosted in other countries is technically feasible despite the above. Any thoughts?

 

[JonJ678]

Snort might be able to distinguish https from ssh on the same port, but I can't find anything suggesting this is the case. I can't recall anything in the config files suggesting it would be capable of this either.

Corkscrew walks through bluecoat just as happily as it walks through other proxies, link.

I'm interested in technical feasibility here, not in the relative merits of iptables and packet filter. A proof of concept hack would be fine. Google primarily throws up "look how easy it is to break through firewalls, lolz".