I’m working on a Flash/Facebook game. My SWF and socket server are on different domains, so I have to use a socket policy file. According to Adobe, they have “filed with IANA, the Internet Assigned Numbers Authority, to reserve port 843 for the purposes of serving socket policy files.” (1) Unfortunately, my server has port 843 closed. I asked my server guy to open the port. Here’s his reply:
One of the points Matt mentioned is even if we open that particular port how would you ensure the scores of people accessing this game from their schools, libraries or even people internal to OurCompany will have connectivity on the port. Let me explain, in order for traffic to flow on port 843 from the browser to the smart fox server, the users ISP also has to allow for that traffic to pass outbound from the users browser. It is possible that several users would not be able to run it, is that risk acceptable?
How common is it for ISPs to block port 843? I assumed that, since this is an Adobe standard, that ISPs would now have it open by default. What’s the scoop?
ISPs can do whatever the heck they want to irrespective to the IANA. There are tons of ports registered with IANA, but vast majority of them are blocked on the inbound unless that ISP runs those services. That’s the point of firewalls to block connections to ports you don’t run services for.
So you have to assume people will be accessing your application over the web browser on networks that sit behind firewalls. The admins of those firewalls could block all outbound traffic except over a few ports like 22 (SSH), 25 (SMTP), 80 (HTTP) 110 (POP3), 143 (IMAP), 443 (HTTPS), etc. Typically, traffic sent outbound is not limited to only those ports because restricting it causes a lot of headaches for the firewall admin because it can interfere with people doing their job. It’s just easier to let the traffic out. And there is little risk of it having an impact on network security. More likely those ports and many others ports ARE blocked for inbound traffic.
Typically most users who are on a corporate network or a managed network have access to computers that sit behind the firewall and can make outbound connections, but nothing outside the firewall can connect to them. That’s typically called network segmentation where the computers used by its employees sit in a more restricted area, and the corps servers live in the DMZ which do have inbound access to limited number of ports. Your server you’re connecting to most likely lives in the DMZ and that’s why you had to ask for port 843 to be opened. And your admin is just saying if someone running the game has outbound traffic limited they won’t be able to use your game because their firewall might block 843 outbound access.
The bottom line? Those people sitting behind firewalls that can’t access port 843 will be unable to run your game. Typically these are corporate or government environments that have tight control over what you can and can’t do with company machines. How many of these exist? It’s in the minority, but basically it just means they shouldn’t be playing games on company time so it’s probably not a big deal that they can’t access it. You could just code for the possibility and tell them “You do not have access to X, and this game requires it, yada yada yada.” If you really wanted to know how prevalent it is you could record it by sending a request back to your server to measure it. Or you could find a way to put your SWF on the same domain as your server which would negate the need for 843.