Need the firewall requirements for firefox vpn option, currently corporate firewall is blocking traffic.
Currently I am trying to use the firefox built in VPN option. When I hit the turn on it turns on and goes green but I am unable to browse. I suspect this is due to the corporate firewall and content filters that are in place when I am in the office. The firewall team is looking for support as we are unable to find out what access is needed to be open for this service to work. What IP's does the service connect to for access? What ports are use for setting up that browser level VPN? Is their any application or urls that should be allowed? If documentation for what access is needed to be opened on a corporate firewall would be appreciated. We have searched extensively and cannot find the information other than this runs by Fastly. We cannot find ports/urls/ips that are needed.
Thanks Chris.
Giải pháp được chọn
These are added and removed from the service remotely as necessary. There will be identity/access/token hits (accounts. …), entitlement checks (vpn. …), and masque 2499 traffic on *.m1.fastly-masque. net (not set in stone, can be foobar.example. net:1234 tomorrow if need be; it's driven by the service endpoints) — for IP information you'd have to watch the CNAMEs I guess.
E.g. for me currently the "recommended" endpoint resolves to 23.235.42.11 and 2a04:4e41:8001::11 no matter where in the world, and the US one to .1 instead for both — seems like these IPs are anycast–esque, so don't differ and map to the hosts' CNAMEs as published.
Tất cả các câu trả lời (6)
Hello,
Firstly, the browser level VPN is mainly an IP protection feature. It is not designed for corporate environments. It is not recommended, as it can create security holes.
This feature is mainly designed for consumers, and is systematically disabled in about:policies. To change this, the IT administrator to change the policies in about:policies to make it work.
This is exactly what we are trying to do. I am an administrator and understand what this does, but we cannot find any documentation on the ports and ip 's that it uses. We have a select set of users that will use this for a specific purpose the masquerade outside of the corporate network and looking to set up this browser vpn to do that feature. We need to poke the holes to allow them browser access outside through with this vpn feature. We used another solution before but that software is now unavailable. I have discovered that it does use port 2499 at times to a fastly ip, but it isn't always and we are chasing this in content filtering currently. It would be nice if there was documentation that would be helpful vs trying to reverse engineer it and wireshark.
Bonjour
https://support.mozilla.org/en-US/questions/1576925
about:policies IPProtectionAvailable https://mozilla.github.io/policy-templates/#ipprotectionavailable Preferences Affected: browser.ipProtection.enabled
These options are a way to turn off the vpn and on the radio options. That is not what I am looking we want to use this option in our environment but need to know what holes to poke in the corporate FW. What urls does it use? what ports? what ip's? etc That is the information that I am looking for to solve. I have run som wireshark and traffic flows and can find it uses 2499/tcp to fastly, but we are still blocked so something is still be blocked in the 443 stream.
Giải pháp được chọn
These are added and removed from the service remotely as necessary. There will be identity/access/token hits (accounts. …), entitlement checks (vpn. …), and masque 2499 traffic on *.m1.fastly-masque. net (not set in stone, can be foobar.example. net:1234 tomorrow if need be; it's driven by the service endpoints) — for IP information you'd have to watch the CNAMEs I guess.
E.g. for me currently the "recommended" endpoint resolves to 23.235.42.11 and 2a04:4e41:8001::11 no matter where in the world, and the US one to .1 instead for both — seems like these IPs are anycast–esque, so don't differ and map to the hosts' CNAMEs as published.
I think this is mostly what I need and have discovered.
Url destinations: fastly.com, fastly.net, fastly-masque.net , you may need to wildcard that is what I am seeing ex. *.fastly-masque.net
Ports needed: udp/tcp 443, tcp-2499
You may run into category limitations like proxy avoidance categories in a nextgen FW that might need to be opened or allowed. But so far we are seeing traffic to those urls and ports. Allowing them has worked and we see the traffic in the FW.
Bạn phải đăng nhập vào tài khoản của bạn để trả lời bài viết. Vui lòng bắt đầu một câu hỏi mới, nếu bạn chưa có tài khoản.