This article applies to:
Question:
- What ports must be closed in the firewall to ensure that WebMarshal Connection Rules are effective?
Response:
WebMarshal Connection Rules allow you to implement policy based control of many Instant Messaging and Streaming Media applications.
Connection Rules apply to HTTP traffic through the WebMarshal server. In order for these rules to be effective, you must ensure that the other ports used by each application are blocked at the firewall. This action forces the applications to communicate via the HTTP proxy.
Consult documentation from the provider of the specific application.
Trustwave has determined that the following ports are used by some applications that WebMarshal can control.
This is NOT an exhaustive list. Many applications can fall back to HTTP/HTTPS if their primary ports are blocked.
Quicktime (RTP/RTSP)
- TCP 554 Inbound / Outbound
- TCP 7070 Inbound / Outbound (Alternate)
- UDP 5004 Send
- UDP 5005 Send / Receive
- UDP 6970 to 6999 Receive
Windows Media
- TCP 1755 Inbound / Outbound
- UDP 1755 Send / Receive
- UDP 1024 to 5000 Send
Note: Windows Media Player uses several protocols and media formats. The above ports are used by the legacy MMS protocol. This protocol is deprecated by Microsoft and it is not supported by Windows Media Player 11 or above. Links that begin with the moniker "MMS://" should roll over to HTTP and be controllable by WebMarshal in most cases, but this depends on the configuration of the streaming media server. If a server only provides MMS connections on port 1755, the content will not be available in WMP 11 or above, either direct or through any proxy.
Real Media
- TCP 554 Inbound / Outbound
- TCP 7070 Inbound / Outbound
- UDP 6970 to 7170 Receive
Note: RealPlayer claims to support HTTP connections. However, the RealPlayer application uses several protocols and media formats. RealPlayer does not successfully use HTTP for all formats. You may find that streaming connections from RealPlayer require ports 554 and/or 7070 to be open at the firewall. The required ports depend on the configuration of the streaming media server.
