-1

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due to this port issue. I can use VPN or proxies and tried using SSH tunneling, but all them require a server outside the country. However, is there any way I can set a source port range to a fixed something in my browser or in my Ubuntu 14.04 machine TCP, so that I get all the replies to some specific port that is not blocked?

N.B.: I used Wireshark to see that the source port Facebook uses is 62200 and Chegg uses is 57116, and the port of StackOverflow (which I can visit) is 17985, so can I change some configuration in my TCP or browser so that Chegg also uses lower port addresses below 20000 to reply?

And also I can visit sites like StackOverflow, GMail, Google etc., so I know port destination port 80/443 is not blocked.
And some of my friends are able to visit Facebook through UC browser without any proxy or anything, so I think the blocking is not so sophisticated.

  • 1
    The source port is arbitrary and wouldn't be used for blocking traffic. – multithr3at3d Nov 27 '15 at 16:33
  • Generally a bad idea to ask for help in breaking your country's laws. I suspect that if I were to answer your question, I would be guilty of racketeering and in violation of the Digital Millennium Copyright Act. – Mark C. Wallace Nov 27 '15 at 17:30
  • I don't want to visit the blocked sites , the list has been given by the government , I want to visit an unblocked site ( chegg) which seems to be blocked for some reason .... – Tamim Addari Nov 27 '15 at 17:36
1

HTTP connections work by the requesting machine selecting a port "randomly" from the range of high level, unused ports. The method for selecting this can vary between different software packages, and is complicated by most consumer level routers implementing NAT, which means that the computer selects one source port to connect to the router on port, say, 80, and the router then selects a source port for it to connect to the remote server on port 80 - this allows for multiple computers to be connected through a single IP address.

It would also be a very strange method of implementing a firewall, since you would have very limited control over what sites were filtered - I suspect that if you repeat your Wireshark monitoring, you will see different source ports for the sites listed. If not, try a different browser - Firefox and Chrome probably use different methods. It's entirely possible that you could find that you can access different sites through different browsers, which again makes me doubt that anyone would use it as a blocking method.

In theory, at least, it would be possible to restrict the ports that your computer attempts to make connections from - a crude way would be to open servers listening on all of the undesirable ports - but unless you are connected directly to the internet, you're likely to be running through NAT, which could select entirely different ports. Those ports, you can't easily see, since they are on the other side of your router.


I would suggest that a more likely issue would be that your ISP has different blocking policies to the one your friends use. Can you access the sites you have problems with from their connections? If so, consider changing ISP!

  • I have a public IP thus not through nat , and the blocking is done in the central gateway ,I called ISP , my ISP told that the port used commonly by social networking sites are blocked . as a result the sites which uses similar ports are also being blocked ... – Tamim Addari Nov 27 '15 at 17:40
1

A source port filtering issue, while still technically possible, seems unlikely to me. I would merely consider a different explanation.

According to Wikipedia the UC browser is a proxy based browser for mobile systems (I guess it is similar to Opera Mobile), this means that:

  • When you use this browser your ISP only sees the connection between your system and UCWeb's servers encoded in a proprietary way, so it is very hard for your ISP to filter anything (an efficient filtering could only occur on UCWeb side and onward),
  • When you use a more classic browser your ISP directly sees the connection between your system and the targeted server (Facebook, etc.), so it is very easy to filter the content based on the target domain name for instance.

Moreover, depending where the filtering actually occurs between you and the targeted server, using a different ISP's can provide different results. Indeed, most often Internet traffic filtering is made by the ISP's themselves, so a different ISP may have implemented their things in different ways.

At last, if by any chance you stick with the idea of altering the source ports, the source port is dynamically allocated by the underlying OS from a range defined somewhere in its configuration. On Windows, this dynamic port range can be configured using the netsh command, on Unix machines this often goes through sysctl settings. But, as I said above, I am quite doubtful there is any point using this as a filtering criteria in this context.

  • I used sysctl to limit the port range to 1024 to 20000 , but I can still see while requested to Facebook port 57000 is used as source port . II changed /etc/sysctl.conf . – Tamim Addari Nov 27 '15 at 17:42
  • @TamimAdDari: Be sure to close and reopen your browser. Existing connections may be kept alive and reused for some time in order to improve performance, so unless you explicitly see the SYN-SYN/ACK-ACK handshake in Wireshark marking a new TCP connection you may be facing an old connection created before you tuned sysctl parameters. – WhiteWinterWolf Nov 27 '15 at 17:58
  • @TamimAdDari in your question (a few hours earlier) Facebook was 62200, so apparently it isn't constant. – dave_thompson_085 Nov 27 '15 at 21:38
  • But it is at higher orders , and I restarted the computer – Tamim Addari Nov 28 '15 at 5:56
  • Here is output of the command sysctl net.ipv4.ip_local_port_range is net.ipv4.ip_local_port_range = 1024 10000 – Tamim Addari Nov 28 '15 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.