4

Firewall kaspersky/avast blocked messages when I'm using a websocket server (socket.io on node.

What can be done?

4
  • Do you mean it is blocking incoming connections to port 8080 and 8000? – kanaka Mar 14 '11 at 23:17
  • 1
    1. with avast don't working websockets and flashsockets protocol, 2 KIS blocking outcoming messages even by AJAX multipart streaming – Bart Mar 15 '11 at 6:41
  • sorry I didn't understand your comment. Can you clarify your setup? Which system is running the browser, which system is running socket.io/node.js, and where the "firewall" is running? Also, please try temporarily disabling your firewall software (make sure you are behind a router with basic firewalling first) and see if that gets things working. Then post you config and results of that test. – kanaka Mar 15 '11 at 14:34
  • Why do you have 2 anti virus programs? – Dave Jul 20 '17 at 8:11
4

I can tell you 100% that Avast for example blocks not only websockets, but from what I see from my Socket.IO app also xhr-polling and other stuff.

This is unacceptable, I've even tested on port 80 and it doesn't work. What an awful piece of software.

Edit: this is a list of blocked ports by antiviruses (Dead 2017-07-20)

2

First rule of Firewall: it can't block what it can't sense.

Does the firewall allow TLS? If so, serve content over WSS instead of WS.

  • A usual WSS client will open a TLS connection to you (source) and send you this:

    GET /demo HTTP/1.1
    Upgrade: WebSocket
    Connection: Upgrade
    Host: example.com
    Origin: http://example.com
    WebSocket-Protocol: sample 
    

    The firewall can't detect it because it is over TLS.

  • A HTTP-CONNECT-WSS client will send you this:

    CONNECT example.com:443 HTTP/1.1
    Host: example.com 
    

    The firewall sees it as yet another HTTP-CONNECT-TLS connection. (source)


Sidenote: websockets can fail due to websocket-unaware intermediary proxies buffering connections even if the firewall doesn't block it. The same is true of HTTP "comet" streaming.

2
  • some companies do packet inspection by installing custom root certs on their computers – wutzebaer Oct 8 '19 at 18:27
  • Changing the protocol from "ws://" to "wss://" solved for me a similar problem with UFW (server-side firewall). – Francesco Galgani Jan 25 '20 at 16:13
0

Many ISP companies block the port 80 to prevent their customers of hosting a web servers on their home computers.

It might beyond your power to unblock the port 80 from your ISP.

Also, as far as I am concerned, Avast is not a firewall.

0

You can try to use port 443 (which is used for https) if it's possible in your case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy