TCP 456 (Class One catering supplier)

[howartp]

We use Class One in Skipton, NYorks as a catering supplier.

 

They've (recently?) launched online ordering, but in school we cannot use it as the page content never loads other than the header/footer/menu structure. https://orders.chefserve.co.uk/classone/#/order/orderEntry

 

Google console shows it's talking to an API endpoint on TCP port 456, which is blocked by our Smoothwall.

 

Long story short, in order to get it working I not only have to unfirewall that port, I also have to go to Web Proxy > Web Proxy > Settings > Advanced and add 456 to the 'Allow access to web servers on these additional ports' box.

 

I've refused to do this now i've proved it as 456 is "Hackers paradise" according to several TCP/UPD Port listings.

 

Anyone else come across this? Anyone else have a view on it?

[mavhc]

Why would they not use port 443? So stupid.

 

Allowing an outgoing port isn't really a problem, unless every other port you allow out is proxied and filtered

 

Can you just allow it for the few IPs that need to access the website?

[DGardiner]

We use Class One in Skipton, NYorks as a catering supplier.

 

They've (recently?) launched online ordering, but in school we cannot use it as the page content never loads other than the header/footer/menu structure. https://orders.chefserve.co.uk/classone/#/order/orderEntry

 

Google console shows it's talking to an API endpoint on TCP port 456, which is blocked by our Smoothwall.

 

Long story short, in order to get it working I not only have to unfirewall that port, I also have to go to Web Proxy > Web Proxy > Settings > Advanced and add 456 to the 'Allow access to web servers on these additional ports' box.

 

I've refused to do this now i've proved it as 456 is "Hackers paradise" according to several TCP/UPD Port listings.

 

Anyone else come across this? Anyone else have a view on it?

id just add a firewall rule for the specific webservers ip - its not worth the hassle, i wouldnt however open it up globally

[MatthewL]

Have you contacted the company in question? The website hasn't been hacked has it?

[howartp]

If I could just add a firewall rule for 456, I would consider doing so.

 

Unfortunately because it is appearing as a website on 456, despite the front end URL being on 443, Smoothwall has another setting that governs whether I can browse to it - where you have to list ports that websites are allowed to be hosted on. This setting is system-wide, not a rule I can build to/from certain IPs/etc.

 

The company are aware as they contacted me, to see if I'd found a solution - as another school seems to have the same issue (presumably also using Smoothwall). I've replied appropriately suggesting they re-think their architecture.

[mavhc]

Just do what everyone else does, api.website.com port 443, or website.com/api port 443

[dmj]

why ?

https://orders.chefserve.co.uk/

 

oh

 

Microsoft-IIS/10.0

[howartp]

why ?

https://orders.chefserve.co.uk/

 

oh

Hehe, yeah I've pointed that out to them as well.