Do network administrators block outgoing traffic to not-well-know ports? [closed]

Question

I've written a Java server to listen on port 49474. My client runs on Android phones all over the US. Of course, they will be connecting from a variety of networks: home, work, school, library, McDonalds. The traffic between the server and client via a Java Socket transferring raw JSON.

Someone told me I have to use port 80 or 443 AND that my traffic must be actual HTTP traffic or routers/firewalls will detect that my traffic is not HTTP traffic and drop it.

How common is it for a network administrator to block connections to ports in the range my port is in?

Also, if I just switch my port number to 443, will a router/firewall detect that my traffic is not HTTP traffic and block even on a well-known port?

Answer 1

Do network administrators block outgoing traffic to not-well-know ports?

Yes. In most managed networks there is likely to be firewall that restricts egress traffic to comply with local policies and to prevent abuse. Actual configurations will differ but you can't universally rely on a uncommon port being open.

Also, if I just switch my port number to a common port number such as 80 or 443, will a router/firewall detect that my traffic is not HTTP(S) traffic and block that?

Even common port numbers may be blocked and the only way users can access the internet via a proxy server which will be able to discern valid HTTP requests.

When the web ports are actually open and the internet can be accessed directly, a firewall can still use deep packet inspection to only allow valid HTTP over the HTTP port, although I have the impression that DPI is not nearly as common as a proxy server.

Recommendation: you'll have the most portability when you use a common web port for your server and your app should honour proxy settings and use HTTP(S).

Answer 2

The short answer is it depends. As with mail servers, it's up to the administrator of the remote network what traffic to accept, and what to deny.

It's true some networks don't allow arbitrary connections from inside to out. I have set up those that do, and those that don't, depending on the security needs of the client.

If your traffic can lawfully be handled over HTTP/HTTPS (you say it's JSON, but if I'm not mistaken, JSON is a content protocol, not a transport protocol) and the server runs on port 80/443, you maximise your chances of people getting to your server. If you step away from a standard port, less clients will be able to reach you. If you run non-standard protocols on standard ports, less clients will be able to reach you.

What you really want to know is the proportion of clients that won't be able to reach you, and I'm not aware of any published work quantifying that. But at the moment I can't see any reason for you not to run this service using a standard transport procotol on its standard port, and until you establish that you have such a valid reason, you'd be foolish not to honour the standards.