Handling embedded port numbers

Question

Hi all: How the heck do you handle http traffic with
embedded port numbers? I just came across a situation like
this:
http://some.web.address:8080
which was blocked by out proxy. Now if port 8080 is the
only port that usually gets passed I can handle that, but
what prevents any port number for being used?
How do you handle this?

Answer 1

here is a real world example of what is failing:
http://video.boeing.com:8080/asx_ext...ts/F4C_HF3-2_V
isibleCamera2_DRM1_96ABW-2009-0394.asx
Chris
>>> On 10/15/2009 at 3:20 PM, in message
<[email protected]>, Craig
Johnson<[email protected]> wrote:
> In article <4AD721D3.CE15.0032.0@N0_$pam.vrapc.com>, Chris
> wrote:
>> http://some.web.address:8080
>>
>> which was blocked by out proxy. Now if port 8080 is the
>> only port that usually gets passed I can handle that,
> but
>> what prevents any port number for being used?
>>
> The proxy will handle embedded port numbers just fine.
> They will be
> passed to the proxy as a url from the browser.
>
> Then you have to understand how the system works. First
> of all, the
> default filters. Default filters block all traffic to
> and from the
> public interface. You therefore need to open certain
> filter exceptions
> up just to allow normal browsing traffic. Novell put in
> two stateful
> exceptions for the typical proxy use: http and ssl.
> (Also allows DNS
> out from the server). This does not include port 8080,
> so in order to
> allow the proxy to use that port, you need to customize
> the filter
> exceptions somehow. One way would be to add a custom
> stateful
> exception for each one of these ports you need. Another
> way is to more
> globally allow traffic from the proxy, which is what I
> do with a series
> of custom filter exceptions (listed in the advanced
> chapter of my BMgr
> Filtering book).
>
> Then, you have to allow the traffic through access
> rules. If you allow
> by URL, you should be set. But if you allowed by HTTP
> or TCP port
> number, then you would need to add an access rule for
> the port number
> involved. (I recommend URL rules.)
>
> Craig Johnson
> Novell Support Connection SysOp
> *** For a current patch list, tips, handy files and
> books on
> BorderManager, go to http://www.craigjconsulting.com ***