What if 5222 port/domain is blocked for Xmpp - security

I have a java Client(Smack API) connecting Openfire server which listens at port 5222.
In one of the deployement scenarios the firewall has blocked 5222(tcp xmpp client communication). Tried using BOSH(Blabber library) , but its not able to handle the load. Whats the solution for this scenario?
I read that even Gtalk uses 5222 but if the network firewall blocks it, they are able to connect seamlessly thru 443 or port 80. How does it work? whats the protocol being used.

If 5222 is blocked, xmpp client over insecure connexions can't connect to your server.
But BOSH is listening over the port 7070 with connect (7070 for unsecure connexion)
In other case, you can post the logs

Related

Beginner question about Ports and server listening

I've just completed a couple of Node.js tutorials and would like a bit of clarification about server port listening and communication between computers in general.
I've created a couple of basic Node.js servers, and what I've learned in that you have to tell your server to listen on a certain port. My questions are as follows:
Say my computer (PC1) is listening on port 3000, does that mean when a client (say PC2) is trying to connect to my server through the internet, the client must be sending their request via port 3000 on their side for my server to receive and respond to the request?
Following on from Q1 - And if PC2 (client) is trying to connect to PC1 (server) and the client's port is different to what the server is listening for, does that mean nothing happens?
This is a very "beginnerish" question. Say I've got a basic Node.js server up and running, and a client makes a request. Before the client information even reaches the server application running in Node.js, a connection between the client and server through the internet must first be established through their IP addresses, right? Then after that, the server application will respond if the port it's listening on is the same port that the client sent the request?
I realise these are basic questions, but I'd really like to firmly grasp these concepts before moving forward with my backend adventure.
Feel free to direct me to any resources you think would help me understand these concepts better.
Many thanks!
If your firewall is off, and you are behind a router that forwards the port 3000 to you, then yes, your 3000 is open and you can connect freely from your publicIP:3000.
What we do normally, we listen on localhost:3000, but we firewall 3000. Then we have a frontend reverse proxy (nginx, HAProxy), that reverses port 80(http)/443(https) to 3000.
Reverse proxy allows listening to different domains as well, so you can have a app on 3000, a app on 3001 for different apps, and redirect different domain to it.
If you cannot access from PUBLIC IP because you are behind a local area network, then you can install something like ngrok which allows you to tunnel your connection from the internet.

UDP connections from website

Is there any way to start a UDP connection from within a website?
So that users can connect to a server listening for UDP packets while being on my website?
If you have full control over the server and the web application running on the server it can be done. If you don't have such control firewall settings or other kind of restrictions you don't control might limit what you can do.

How to have both HTTP and TCP server on Heroku

I intend to deploy a nodejs app on Heroku which is both an HTTP and TCP server. I can see that I can map my application to a routed port using process.env.PORT. However, this would be just one port, yes? I couldn't map both my HTTP server and TCP server to the same port. Is there a way that I can do this, possibly by getting a second routed port?
Please note, my TCP client applications are not necessarily going to be nodejs (probably Python), so I need something lower level than socket.io and websockets. I was going to use net.
TCP and HTTP are in different layers.
HTTP is under the Application Layer.
TCP is under the Transportation Layer.
An HTTP client initiates a request by establishing a Transmission Control Protocol (TCP) connection to a particular port on a server (typically port 80).
In computer networks, every application is getting/asking from the operating system a port that it can listen to.
If you have 2 TCP servers- one is HTTP server and the other one is another server, they can't listen to the same port, unless you have two NI because of the TCP protocol operations.

Configure XSockets to use the handshake port

From my understanding, WebSockets has been designed to traverse firewalls and proxies. Indeed, after an handshake between the client and the server, the communication protocol will change from HTTP to WS but it will still communicate on the port used to establish the handshake. (See websocket.org).
In other words, if a client can do an HTTP request on a given port, he will also be able to do WS on the same port.
However, according to XSockets configuration documentation, the port used for WS communications isn't the same as the HTTP port. Unlike a regular WS connection, a NAT on the firewall seems to be required to allow communication between the XSockets server and the client.
Is there a way to configure an XSockets server to re-use the HTTP port used for the handshake (port 80) without creating conflicts with the existing web applications hosted on the same web server (IIS)?
You are right. But, the application listening on the web port, should be able of understanding WebSocket protocol in order to do the handshake, and that is not the case of IIS < 8.
If you want to have your WebSocket running on the same port than your web application, you need IIS 8 (included in Windows >= 8 and >= 2012).
As far as I know XSocket allows you to use IIS8 as hosting environment: http://xsockets.net/docs/hosting#using-iis8
But if you have IIS < 8 , then it is not possible. It is not a XSocket limitation, it is a IIS limitation.

web2py makes no http connection, how does it communicate with browsers

I was trying to sniff HTTP packets though wireshark on my localhost, when i tried working on a web2py instance at my localhost no http connections found. While digging deeper into it i found it is not creating `any connections in the application layer. well then how does it communicate with browsers without http? (I have heard of web2py as a very secure framework, now this thing is creating more curiosity in me)
Are you sure it's not an HTTP connection on port 8000 (which is the IANA registered port for irdmi)? If you use wireshark, you can choose to decode as HTTP when the port isn't the standard port for the protocol.

Resources