5
\$\begingroup\$

Forgive me if this comes off as naive; I've only a cursory understanding of network communications.

My work has a public and very restrictive network - (they appear to block everything that isn't approved) - and yet I've seen people accessing many games (World of Warcraft for example). I don't imagine that the network admins made any explicit exceptions for these applications - but when I tried to develop a networked prototype with services like 'Photon Server' or 'Adobe's RTMFP' they all fail from the office due to the network restrictions (can't establish connection).

Is there some kind of work around that applications like WoW employ that distinguish them from an anonymous networked app I've built myself? (Some kind of fallback channel maybe?)

I appreciate that there might not be enough information here for an answer, but any insights would be welcome.

Thank you!

\$\endgroup\$
  • 4
    \$\begingroup\$ My admittedly limited understanding is that firewalls typically block incoming connections, so you can't run a server behind your firewall, but not outgoing connections, so a game client establishing a connection to an external server is fine. It's not clear to me from your question whether the apps you were trying to run are servers or clients, though. \$\endgroup\$ – Nathan Reed Sep 27 '13 at 21:38
  • \$\begingroup\$ @NathanReed: Many firewalls also block out-going connections to prevent users from running unauthorized Internet-using applications. Somewhat less effective in our Web-oriented world where everything runs off of HTTP(S), but I have encountered plenty of networks that have blocked most IM protocols, SSH, games, etc. Sounds like that's the OP's issue, not incoming connections, as he mentioned WoW. \$\endgroup\$ – Sean Middleditch Sep 28 '13 at 6:55
  • \$\begingroup\$ I once worked at a company which opened up the necessary firewall ports for World of Warcraft during the company-specified lunch hour. The owner of the company was, perhaps unsurprisingly, a big fan of the game. \$\endgroup\$ – Trevor Powell Sep 28 '13 at 23:31
7
\$\begingroup\$

The topic of "getting around" firewalls is not as easy as it sounds.

To make it simple, no program can consistently get around all firewalls, and no firewall can consistently stop all undesired applications.

A firewall is simply an element you place in a point in your network, to analyze packets, and based on a set of rules, act upon them.

Depending on the hardware and software that a firewall uses, a firewall can be set to do very simple tasks, to extremely complex ones. So let's see those bolded words up there:

  1. Analyze: If you remember networking 101, data in a network is layered. When you ask the stackexchange servers to show you this page, the stackexchange server gets:

    • An HTTP request (application layer)
    • Inside a TCP segment (transport layer)
    • Inside an IP datagram (internet layer)
    • Most likely inside an Ethernet frame (link layer)

    Firewalls can be set to analyze network traffic at any layer, and for all layers, there are different things that can be analyzed. For example, a firewall that can analyze data at the transport layer, will most likely be able to read TCP flags, TCP ports, among others.

    Usually, the higher the layer at which a firewall can analyze, the more complex and expensive it becomes.

  2. Rules: Once the data to analyze is set, a bunch of rules are created. Once again, rules can be very simple, or very complex. The more complex rules can be set, the more complex and expensive the firewall becomes. Examples of rules are:

    • Allow outgoing TCP segments for TCP port 80
    • Block incoming TCP segments where the flags include SYN, but not ACK
    • Allow incoming TCP segments for TCP port 22, only for 10.5.20.4
    • Block outgoing TCP segments for TCP port 80, where the stream does not look like an HTTP request
    • Block incoming and outgoing UDP datagrams on port 4658, from 10 AM to 8 PM. Log all blocked traffic

    Depending on the type of firewall, the type of stuff you can include on a rule can be either very simple or very complex

  3. Act: Finally, when a rule is hit, a decision is made, and something is done with the data. Usually, data is either allowed or blocked. However, some firewalls also let you log the data, delay it, modify it, or some more esoteric options.

So, the important thing to notice here is that each firewall has a different configuration, and there are as many configurations as there are firewalls around.

That said, there are some common firewall settings, which a game can be coded to get around of. For example, many firewalls block all incoming traffic for which there are no active connections (as in most home wireless routers). A simple way around this is to make all connections start from the client.

Other common rules are to block all traffic that is not TCP port 80. A way around this is to make a game that uses port 80.

However, for every way around a rule, there is another possible rule to catch it, and for all rules, there are ways around it. So really, it's a cat-and-mouse game.

In conclusion, there is no way to get around all firewalls. Some games are made to get around some common firewall rules, and some others are made to get around some more complex ones. How they do it is completely up to the game creators, how the game works, and the type of rules they want to get around. Sometimes it will work, sometimes it won't/

\$\endgroup\$
1
\$\begingroup\$

The firewall usually can't tell what application the connection is initiated from. Hence, if something like World of Warcraft is able to connect to its server on port 80 (HTTP), it will succeed, as the firewall will be unable to distinguish it from normal web browsing.

The developers of such applications often choose such ports for servers for this reason - it will reduce the number of cases that firewalls get in the way.

\$\endgroup\$
  • \$\begingroup\$ Some firewalls can use some level of packet inspection to defeat apps using standard ports for non-standard protocols. A complete tcp-over-http proxy is needed in those cases. \$\endgroup\$ – Sean Middleditch Sep 28 '13 at 20:47
  • \$\begingroup\$ Many games can use TCP as a fallback over UDP - that's why it works. \$\endgroup\$ – Matt Randell Sep 29 '13 at 10:21
1
\$\begingroup\$

According to http://www.adobe.com/uk/products/adobe-media-server-extended/rtmfp-faq.html RTMFP uses UDP. http://www.exitgames.com/Photon/Unity also suggests that Photon Server only uses UDP.

World of Warcraft uses TCP.

I wouldn't be surprised if your firewall simply doesn't allow UDP through.

\$\endgroup\$
  • \$\begingroup\$ Photon uses UDP on default, but will use TCP instead, if one specifies so in the Photon client API. \$\endgroup\$ – Kaiserludi Oct 2 '13 at 13:08
0
\$\begingroup\$

Its likely that not the firewall settings of your client machine are the problem, but the ones of the machine, where you run your server. For WoW you just install the client and Blizzard hosts the servers, so they care about the server side firewall settings, but when you run your own server, then you have to care about the server side firewall settings.

For Photon Server you can read at http://doc.exitgames.com/photon-server/Requirements/#cat-getting_started, which ports to open on the server side.

You could also just register a free account for Photon Cloud, where you don't have to setup or host the server yourself, and see, if you can connect to the Photon Cloud from your workplace. If that works fine, than your problems are most definitely caused by the server side firewall settings.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.