Blocking OperaVPN (Opera Browser Built-in VPN) on UniFi Cloud Gateway Ultra

block-operavpn-unifi.md

Blocking OperaVPN (Opera Browser Built-in VPN) on UniFi Cloud Gateway Ultra

Last tested: June 2026 | UniFi OS version: 10.4.57 | Works on: UCG-Ultra, UDM-Pro, UDM-SE (any UniFi gateway with Policy Engine)

The Problem

Opera's built-in VPN bypasses content filtering, parental controls, and DNS-level blocks on your UniFi gateway. Standard approaches fail:

What people try	Why it fails
Blocking AS39832 (Opera Norway AS)	The VPN tunnel doesn't go through Opera's ASN. It's hosted by HERN Labs AB (AS205016) on completely different IPs.
Blocking DNS (port 53) redirection	OperaVPN resolves its proxy hostnames inside the encrypted tunnel — your gateway never sees the DNS queries.
Blocking OpenVPN/WireGuard ports	OperaVPN isn't a real VPN. It's a SOCKS5 proxy tunneled over standard TLS on port 443 — indistinguishable from regular HTTPS.
Blocking port 443	Breaks the entire web.

How OperaVPN Actually Works

1. Opera browser connects to *.sec-tunnel.com proxy servers on port 443
2. Inside that TLS tunnel, a SOCKS5 proxy handshake occurs
3. All browser traffic is forwarded through that proxy
4. DNS resolution happens inside the tunnel — your gateway sees only TCP 443 → Cloudflare-like IP

The proxy infrastructure is operated by HERN Labs AB (AS205016), not Opera Software.

The Fix

Step 1: Identify the current tunnel IPs on YOUR network

Opera may rotate its proxy IPs. Don't guess — capture your own traffic:

1. Install PCAPdroid on an Android device (no root — available on Google Play or F-Droid)
2. Open PCAPdroid, start a new capture (VPN mode)
3. Open Opera browser → enable the built-in VPN
4. Browse normally for 30-60 seconds
5. Export the capture as CSV
6. Look for connections to sec-tunnel.com subdomains — especially patterns like am*.sec-tunnel.com and api2.sec-tunnel.com

The IPs will cluster in the 77.111.246.0/23 range (HERN Labs AB).

Step 2: Apply the blocks on your UniFi gateway

Create a Network List (Address Group)

Policy Engine → Objects → Networks → Create Network List

Field	Value
Name	OperaVPN Proxy
Type	Network
Entries	77.111.246.0/24, 77.111.247.0/24

(Adjust these if your PCAPdroid capture shows different ranges.)

Create a Policy Rule (Firewall Rule)

Policy Engine → Policy Table → Create Policy

Field	Value
Name	Block OperaVPN
Source Zone	Your internal network zone (e.g. Corporate, LAN, or kids' VLAN zone)
Destination Zone	Internet
Source	Any (or the specific kids' VLAN/subnet)
Destination	Network List → OperaVPN Proxy
Action	Drop

Add DNS-level blocks

Add these domains to your DNS content filtering block list:

• sec-tunnel.com
• opera-proxy.net

Keep your existing protections

• AS39832 block — still worth keeping. It blocks Opera's analytics, telemetry, and push notification servers, even though it doesn't stop the VPN tunnel.
• Encrypted DNS redirect (DoH/DoT blocking) — keeps standard browsers (Chrome, Firefox, Edge) from bypassing your DNS filtering with DoH/DoT.
• Port 53 redirect — keeps devices from using third-party DNS servers.

Step 3: Verify

On the Android device (or any device on the protected network):

1. Open Opera
2. Go to Settings → Enable VPN
3. You should see something like "Failed to connect to VPN" or a persistent Connecting... spinner
4. Browsing continues normally (through your gateway's DNS filtering), just without the VPN tunnel

Checking Your UniFi Policy Logs

If you enabled logging on the policy rule, you can verify blocks are hitting:

Policy Engine → Policy Table → click your Block OperaVPN rule → view logs/statistics.

If OperaVPN Starts Working Again

Opera may switch proxy providers or IP ranges. When that happens:

1. Run another PCAPdroid capture
2. Look for the new tunnel endpoint IPs — they may be in a completely different ASN
3. Update your Network List entries
4. (Optional) Check dig +short sec-tunnel.com and dig +short api2.sec-tunnel.com to see if the base domain resolves differently

FAQ

Why not just block *.sec-tunnel.com at the DNS level?

Because OperaVPN resolves sec-tunnel.com inside its own tunnel — DNS blocking only catches fallback traffic when the VPN is already failing.

Why not block all Cloudflare IPs (AS13335)?

Cloudflare is used by ~20% of the web. Blocking it would break most of the internet for your kids.

Does this affect legitimate Opera browser functionality?

No. The 77.111.246.0/24 and 77.111.247.0/24 ranges are exclusively used by OperaVPN's proxy infrastructure. Normal browsing, bookmarks, sync, and news feed continue to work through Opera's own AS39832 servers.

What about Opera GX?

Opera GX uses the same sec-tunnel.com proxy infrastructure. The same blocks apply.

Current known proxy ranges (June 2026)

Range	ASN	Provider
77.111.246.0/24	AS205016	HERN Labs AB
77.111.247.0/24	AS205016	HERN Labs AB

These may change. Always verify with your own capture if the VPN starts working again.

---

License

This is free, unlicensed information. Use it however you like. If you find updated IP ranges, consider submitting a pull request or commenting to help others.