(I've read several questions here about websocket but apparently there's no websocket tag)
If I understand correctly websockets are using TCP trafic over port 80.
What are the implication, if any, for rigorous firewalling rules? For example if I have a firewall only accepting related and established trafic and incoming "TCP packet with state NEW" (the others being taken care of by the related and established packets), will that still allow websocket trafic through?
Also, is websocket trafic part of the already established trafic when a user connects to a website?
Note that this is not a question about iptables and the following example should simply serve to illustrate my above purpose. Say I have something like this:
a) iptables -I INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
b) iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
c) iptables -I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
by which rules would websocket be matched? Only b) and c) or would websocket create initiate it's own TCP connection? (from the client?)
Basically I think my question boils down to: are the any specific firewall settings that needs to be done to allow websockets?
Also, should a major websocket security issue be discovered or should a website decide to not use websocket, can this be blocked at the firewall level?