Port 5223 traffic

[enjay]

We've recently enabled Lightspeed's proxy bypass detection, and it is flagging traffic to various IPs on port 5223. I know one of these IPs is WhatsApp, the others are somewhere in Amazon AWS so might be legit and might not be (I know things like Betternet VPN used AWS servers), but a quick Google search would suggest the things which use port 5223 are Apple Push Notifications and a few IM clients. So, I'm wondering if it is a safe assumption this traffic is never going to be a proxy bypass attempt, and I could therefore whitelist all port 5223 traffic in proxy bypass filters. The content filters will still pick up and block any sites which the student shouldn't be visiting, I just want to whitelist the false positives in the proxy bypass detection (because I can then enable 5-minute bans on students who are genuinely attempting to bypass the filters with the likes of Betternet and Psiphon).

 

So, can I tell the bypass detection to trust anything on 5223 or should I be more discerning?

[pete]

I'd say more discerning, since it'd be trivial to set a proxy to listen on 5223.

 

Allow 5223 to Apple domains / IPs if you care about push notifications (phone-based 2FA uses them, for example).

 

Then see who yells regarding the rest or break out Wireshark to determine if they're legit.

[enjay]

I'd say more discerning, since it'd be trivial to set a proxy to listen on 5223.

 

It might be trivial to you, but I don't think our average student could do it. Or know port 5223 is open on our network anyway. Plus, even if they did manage to get past the proxy bypass detection, they'd still have the content filtering to contend with, which I suspect would block their proxy anyway either because students can't browse to IP addresses or because the domain name you set on it would be unrecognised.

 

I'm not particularly trying to block the determined hacker, more just the student who has searched for "apps to get round filtering" and then installed one of the top 3 results.

[enjay]

So, other than an enterprising student setting up their own proxy specifically on 5223 (a risk I'm happy to take), is there any other reason not to tell the proxy bypass detection to trust all 5223 traffic? The content filters will still be in place, so any 5223 traffic they don't like will still be blocked, it just won't be flagged as an attempt to bypass the proxy and therefore won't impose an automatic 5 minute ban.