(I've read several questions here about websocket but apparently there's no websocket tag)

If I understand correctly websockets are using TCP trafic over port 80.

What are the implication, if any, for rigorous firewalling rules? For example if I have a firewall only accepting related and established trafic and incoming "TCP packet with state NEW" (the others being taken care of by the related and established packets), will that still allow websocket trafic through?

Also, is websocket trafic part of the already established trafic when a user connects to a website?

Note that this is not a question about iptables and the following example should simply serve to illustrate my above purpose. Say I have something like this:

a) iptables -I INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
b) iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
c) iptables -I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

by which rules would websocket be matched? Only b) and c) or would websocket create initiate it's own TCP connection? (from the client?)

Basically I think my question boils down to: are the any specific firewall settings that needs to be done to allow websockets?

Also, should a major websocket security issue be discovered or should a website decide to not use websocket, can this be blocked at the firewall level?


1 Answer 1


From what I know of the WebSockets protocol whilst it allows two way message passing, at a TCP level the connection is initiated by the client and as such the most firewall configurations (e.g. those which allow standard web browsing) will allow WebSockets communication without further configuration. Indeed looking at the Wikipedia Article, this is touted as one of the benefits of the protocol.

The flip side of this is that blocking it wouldn't be possible if the firewall only works at an IP address/ TCP port level, it would need to understand more of the semantics of the protocol to understand when it was being used. Also if blocking Websockets connections over SSL is needed then the proxying device would need to be able to intercept and decrypt the SSL connection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .