0

We use software from Genesys that uses its own proprietary protocols (all TCP) and we often run into issues with customers firewalls. The ports we are using are 2000, 2200 and 3010 - I'm not sure where we came up with these but thats what we do for every deployment.

The problem is we run into lots of issues even when the port has been opened on the firewall.. Some firewalls still give us grieve for the traffic and this usually comes down to the fact we have used a port that is well known and firewalls want to be fancy and make sure the traffic on that port matches the expected protocol/traffic. An example of this is port 2000 which is Cisco SCCP.

My question: is there any ports that would be best to use for proprietary protocols like this? For example, ports that don't have default firewall inspection behaviour.

It's very painful especially when the person operating the firewall doesn't really understand it well - sometimes it takes them a long time to realise it's doing this type of inspection/blocking since they've added a rule to allow it..

[UPDATE 2020-04-01] I've updated the post to hopefully make it a bit clearer. I understand that the ports need to be opened on the firewall - my question and the issues I've experienced is around the firewall still inspecting/blocking/impacting traffic even after the port has been allowed.

  • The point of a firewall is that it blocks all outside-initiated traffic by default. You need to create rules to allow what you want to allow. – Ron Maupin Mar 31 at 13:22
  • @RonMaupin I've updated the question.. I understand the port needs to be allowed with a rule, but my issue/question is relation into what happens after allowing the port.. see above for the update – jmurphyau Mar 31 at 22:35
2

I've updated the question.. I understand the port needs to be allowed with a rule, but my issue/question is relation into what happens after allowing the port.. see above for the update

You could always register some port numbers with IANA that are only for your protocols. Alternatively, look at the IANA Service Name and Transport Protocol Port Number Registry for port numbers that are not already claimed by other registered protocols. That is the point of the protocol registry, so that you do not try to use ports that others have registered for their own use. For example, ports 4434 to 4440 are unassigned. Just understand that someone else may come along and register the port numbers that you are using.

| improve this answer | |
  • is there anything special required for registering ports on the IANA Service Name and Transport Protocol Port Number Registry? I assume that the software developer (Genesys) would need to go through that process, rather than some random (me) trying to do it? – jmurphyau Apr 1 at 0:03
  • You can read all about it. The page has links to the various RFCs describing what you need to do: "The registration procedures for service names and port numbers are described in [RFC6335]. Assigned ports both System and User ports SHOULD NOT be used without or prior to IANA registration." – Ron Maupin Apr 1 at 0:06
1

Many firewall operators choose to block all ports but the ones used by permitted protocols, esp. 80 and 443. Accordingly, these may be the only ones that get through. There is no 'agreed-upon' port range that is allowed out - that would defy the purpose of blocking undesired/exotic protocols.

However, many firewalls today deep-inspect HTTP and HTTPS ('next-generation' firewalls, UTMs) and may block non-HTTP/S protocols on those ports as well.

You best option is to use the standard/common ports and hope they get through. Using non-standard ports or reusing HTTP/S ports may increase suspicion and the likelihood of blocking.

Another option is to provide a tunneling device. E.g. you could tunnel over HTTP/S without the firewall actually noticing what's going on. However, note that product or resource recommendations are explicitly off-topic here.

| improve this answer | |
  • I've updated the question to make it a bit clearer. I understand the port needs to be allowed with a rule, but my issue/question is relation into what happens after allowing the port.. see above for the update – jmurphyau Mar 31 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.