15 ms·

I hate public WiFi that blocks arbitrary ports. The internet is not HTTP!!

by ars 3y ago

pixl97 3y ago
At the same time free public Wifi is just that, a "we do what we can and try to keep the infra safe at low cost". There is a lot of tooling to filter out bad behavior by HTTP. When it comes to other protocols, not so much. Much easier to block other ports then end up with your IP range on a block list.
- bombcar 3y ago
  What I'd like to see, is public Wifi setup with something akin to "HTTP/HTTPS - wide open" and "all other ports, you can connect to 1-5 machines an hour" or something. Blocks useful access for worms, Trojans, etc but still lets you get out once.
  - taway1237 3y ago
    Trojans only need to connect to one server (c&c) and they usually use http(s). Worms are almost nonexistent nowadays. Spambots are a concern (some of which could be consider a worm if you squint hard enough), but they only need to connect to two servers (configured SMTP server and C&C).
m463 3y ago
I think ports < 1024 is not so arbitrary.
marcod 3y ago
Don't you know that ssh is only used by hackers?!?!!!1
em-bee 3y ago
i use mosh. it uses high ports that shouldn't be blocked. usually it is already running when i open the laptop. saves a lot of time. as an added benefit, it sometimes even works when the actual wifi connection is not yet authorized at the portal because that often only blocks tcp and not udp.
dmm 3y ago
Another option is an ssh/https multiplexer like sslh: https://github.com/yrutschle/sslh https://github.com/yrutschle/sslh It allows you to listen for https and ssh traffic on a single port.
- rnhmjoj 3y ago
  I found this recently too: it's a bit trick to setup, but it works very well for my usecase and I did not notice any performance issues. Basically your services listen on localhost:port, sslhd listens on hostname:port, inspects the packets and forwards them (transparently) to localhost:port. If you put everything on port 443 it's very unlikely they will ever be blocked.

I hate public WiFi that blocks arbitrary ports. The internet is not HTTP!!

by ars 3y ago

I hate public WiFi that blocks arbitrary ports. The internet is not HTTP!!

At the same time free public Wifi is just that, a "we do what we can and try to keep the infra safe at low cost". There is a lot of tooling to filter out bad behavior by HTTP. When it comes to other protocols, not so much. Much easier to block other ports then end up with your IP range on a block list.

bombcar 3y ago
What I'd like to see, is public Wifi setup with something akin to "HTTP/HTTPS - wide open" and "all other ports, you can connect to 1-5 machines an hour" or something. Blocks useful access for worms, Trojans, etc but still lets you get out once.
- taway1237 3y ago
  Trojans only need to connect to one server (c&c) and they usually use http(s). Worms are almost nonexistent nowadays. Spambots are a concern (some of which could be consider a worm if you squint hard enough), but they only need to connect to two servers (configured SMTP server and C&C).

m463 3y ago

I think ports < 1024 is not so arbitrary.

marcod 3y ago

Don't you know that ssh is only used by hackers?!?!!!1

em-bee 3y ago

i use mosh. it uses high ports that shouldn't be blocked. usually it is already running when i open the laptop. saves a lot of time. as an added benefit, it sometimes even works when the actual wifi connection is not yet authorized at the portal because that often only blocks tcp and not udp.

dmm 3y ago

Another option is an ssh/https multiplexer like sslh: https://github.com/yrutschle/sslh https://github.com/yrutschle/sslh It allows you to listen for https and ssh traffic on a single port.

rnhmjoj 3y ago
I found this recently too: it's a bit trick to setup, but it works very well for my usecase and I did not notice any performance issues. Basically your services listen on localhost:port, sslhd listens on hostname:port, inspects the packets and forwards them (transparently) to localhost:port. If you put everything on port 443 it's very unlikely they will ever be blocked.