Best ports to use for proprietary protocols that might get inspected/blocked by firewalls

Question

We use software from Genesys that uses its own proprietary protocols (all TCP) and we often run into issues with customers firewalls. The ports we are using are 2000, 2200 and 3010 - I'm not sure where we came up with these but thats what we do for every deployment.

The problem is we run into lots of issues even when the port has been opened on the firewall.. Some firewalls still give us grieve for the traffic and this usually comes down to the fact we have used a port that is well known and firewalls want to be fancy and make sure the traffic on that port matches the expected protocol/traffic. An example of this is port 2000 which is Cisco SCCP.

My question: is there any ports that would be best to use for proprietary protocols like this? For example, ports that don't have default firewall inspection behaviour.

It's very painful especially when the person operating the firewall doesn't really understand it well - sometimes it takes them a long time to realise it's doing this type of inspection/blocking since they've added a rule to allow it..

[UPDATE 2020-04-01] I've updated the post to hopefully make it a bit clearer. I understand that the ports need to be opened on the firewall - my question and the issues I've experienced is around the firewall still inspecting/blocking/impacting traffic even after the port has been allowed.

Answer 1

I've updated the question.. I understand the port needs to be allowed with a rule, but my issue/question is relation into what happens after allowing the port.. see above for the update

You could always register some port numbers with IANA that are only for your protocols. Alternatively, look at the IANA Service Name and Transport Protocol Port Number Registry for port numbers that are not already claimed by other registered protocols. That is the point of the protocol registry, so that you do not try to use ports that others have registered for their own use. For example, ports 4434 to 4440 are unassigned. Just understand that someone else may come along and register the port numbers that you are using.

Answer 2

Many firewall operators choose to block all ports but the ones used by permitted protocols, esp. 80 and 443. Accordingly, these may be the only ones that get through. There is no 'agreed-upon' port range that is allowed out - that would defy the purpose of blocking undesired/exotic protocols.

However, many firewalls today deep-inspect HTTP and HTTPS ('next-generation' firewalls, UTMs) and may block non-HTTP/S protocols on those ports as well.

You best option is to use the standard/common ports and hope they get through. Using non-standard ports or reusing HTTP/S ports may increase suspicion and the likelihood of blocking.

Another option is to provide a tunneling device. E.g. you could tunnel over HTTP/S without the firewall actually noticing what's going on. However, note that product or resource recommendations are explicitly off-topic here.

Answer 3

Its avoid such issues in future . Make sure your application is hosted on service port TCP-80 & TCP - 443 which are standard ports . In terms of security propective it's better to use only TCP-443 ports and allow application ip SSL if next generation firewall is used .

Otherwise you need to give clear understanding for firewall engineer to open ports in firewalls for incoming or outgoing traffic as per requirement for non -standard ports . But this is not considered to be good practice..