Allow Whatsapp and iMessage through firewall

[speckledegg]

Hi guys,

 

Was wondering if anyone knew the ports needed to allow Whatsapp and iMessage to work though a firewall?

 

We have Smoothwall Advanced Cloud which is controlled by the LA who action firewall requests. We only have access to SWURL to unblock and allow websites for the school.

 

Any help would be greatly appreciated!

[timbo343]

We have Whatsapp allowed through the firewall of our Smoothie for syaff and 6th form. I forget which ports need to be opened but i followed a guide on the net from smoothwall and it worked.

[speckledegg]

We have Whatsapp allowed through the firewall of our Smoothie for syaff and 6th form. I forget which ports need to be opened but i followed a guide on the net from smoothwall and it worked.

It wasn't this guide by any chance was it?

https://kb.smoothwall.net/Content/applications/allowWhatsApp.htm

 

Just want to be sure I'm on the right track! ;-)

[timbo343]

Yup that was the one.

[speckledegg]

Thanks for confirming, will take a look at this and see how I get on!

[truebluesteve]

I managed to get this working but photos don't upload - any ideas why?

[timbo343]

we have the following set in a category group called APP - WHATSAPP

[5tu]

According to https://www.whatsapp.com/cidr.txt, IP pool updates are now published on the Facebook Mobile Partner Portal. I wonder if smoothwall have signed up to receive updates? If not, the published kb might well be out of date.

 

Thoughts @TE_Smoothwall?

Edited November 8, 2017 by gybe78

[GuyJD]

I managed to get this working but photos don't upload - any ideas why?

I've had to allow the url http://mmg.whatsapp.net/ otherwise pictures fail to send and download

[TE_Smoothwall]

According to https://www.whatsapp.com/cidr.txt, IP pool updates are now published on the Facebook Mobile Partner Portal. I wonder if smoothwall have signed up to receive updates? If not, the published kb might well be out of date.

 

Thoughts @TE_Smoothwall?

 

I will flag this to our categorisation team

[Shwaa]

FYI:

WhatsApp uses XMPP for the text messages, but uses 443 and various sub domains of whatsapp.com and whatsapp.net for media (photos, videos, audio etc).

 

To get it fully working you need to allow TCP port 5222 on the firewall and also allow the whatsapp.com and whatsapp.net sub domains on the web filter. In our case I just allow all of whatsapp.com and whatsapp.net to the groups that are allowed access to WhatsApp rather than play the endless game of chasing down which sub domains they are using/change to.

 

If you only want to open port 5222 for WhatsApp IPs, then it gets trickier as the knowledge base article is almost certainly out of date. The addresses listed may still work, but there is no guarantee that they will continue to. Ideally Smoothwall should include IP address objects for well known services that can be used for creating targeted firewall rules.

 

 

For iMessage, it uses TCP 80, 443 and 5223. You will probably only have to open 5223 on the firewall as the traffic going through 80 and 443 will likely be passing through the web filter, which makes it easy to spot if you have any rules that are blocking it.

 

Fortunately Apple owns the entire 17.0.0.0/8 address block, so it is relatively simple to create targeted rules to allow specific ports to be open just for Apple services.

[drewp]

I will flag this to our categorisation team

 

Just wondering if you were able to get an updated CIDR for WhatAapp

[timbo343]

We used to have Whatsapp working for staff and 6th form but due to the certificate issues on devices, we are finding that whatsapp doesn't work any more.

[drewp]

Had the IP Addresses in the KB article as web filter exceptions for a while now and not had any complaints about it not working.

 

With the recent change to WhatsApp's Terms of Service for the European Region, I'm trying to block it for groups of pupils that are under the required age to use it while keeping it working for those that can use it.

 

I don't think creating a firewall rule for the groups with the IP addresses in the KB article will block it, Wireshark suggests that different IP addresses are now being used.

[Opendium_Steve]

I don't think creating a firewall rule for the groups with the IP addresses in the KB article will block it, Wireshark suggests that different IP addresses are now being used.

 

WhatsApp used to publish a list of IP addresses, but many of the IP addresses changed some time ago and they no longer publish the IP address list. We now use a combination of deep packet inspection and our own IP list derived from Facebook's AS number to control WhatsApp. Voice/Video is peer-to-peer traffic though, so the only way to control that is with deep packet inspection.

 

(The official IP address list is still available to the mobile phone network providers, but Facebook flatly refuse to give it to anyone else, even filtering providers like ourselves - no idea why!)

[Zoom7000]

WhatsApp used to publish a list of IP addresses, but many of the IP addresses changed some time ago and they no longer publish the IP address list. We now use a combination of deep packet inspection and our own IP list derived from Facebook's AS number to control WhatsApp. Voice/Video is peer-to-peer traffic though, so the only way to control that is with deep packet inspection.

 

(The official IP address list is still available to the mobile phone network providers, but Facebook flatly refuse to give it to anyone else, even filtering providers like ourselves - no idea why!)

 

I've got this very same problem. I want to unblock these IPs to allow WhatsApp Voice Calling, but can't get the correct destination IPs in order to get our ISP to unblock them on our firewall.

 

Would anyone be able to point us in the direction of a list or be willing to share?

Edited August 7, 2018 by Zoom7000

[Zoom7000]

For anyone that's interested, I just managed to get this working through our LGfL firewall which was blocking WhatsApp calls. I did some packet captures on our Meraki APs and also cross referenced it from a Facebook IP list from 2016 which I found here.

 

Here is the list of all the IPs I had unblocked:

 

31.13.0.0/17

45.64.40.0/22

66.220.144.0/20

69.63.176.0/20

69.171.224.0/19

74.119.76.0/22

103.4.96.0/22

129.134.0.0/16

157.240.0.0/16

173.252.64.0/18

179.60.192.0/22

185.60.216.0/22

204.15.20.0/22

 

Here are the ports that needed to be unblocked:

 

TCP: 4244, 5222, 5223, 5228, 5242

UDP: 3478, 45395

TCP & UDP: 50300-59999

 

I've just tested a WhatsApp call with the Mrs and all was working perfectly!

[drewp]

This might be of interest - https://developers.facebook.com/docs/whatsapp/guides/network-requirements/#ipaddresses

[MayJames]

just wanted to know if you asked lgfl for firewall rules or MIP inbound request rules?

 

any chance you could share the firewall request excel file which they ask for we are trying to unblock whatsapp though lgfl also and struggling?

[Zoom7000]

just wanted to know if you asked lgfl for firewall rules or MIP inbound request rules?

 

any chance you could share the firewall request excel file which they ask for we are trying to unblock whatsapp though lgfl also and struggling?

 

I've sent you a PM, but simply create a spreadsheet from the txt file on the link above and ask them to unblock those IPs for the ports that I've posted above.

[FishCustard]

I've sent you a PM, but simply create a spreadsheet from the txt file on the link above and ask them to unblock those IPs for the ports that I've posted above.

 

Do they need to be unblocked inbound and outbound or just outbound?

 

I did both only because I was having issues with call dropping on WhatsApp calls. Most of what I did was trial and error to get it working.

Edited November 1, 2019 by Zoom7000