Esports Local Authourity Filtering and Firewall issues

[PotNoodleTech]

Yo Gamers.

 

From what I can see the biggest barrier to Esports take up in schools other than PCs without graphics cards,  is the LA not being able to cater for the Games etc with their firewall and filtering.  This has led to big delays in schools I know where they've tried to get it working, wated weeks/months then had to get their own broadband line in not using the usual filtering which is risky from my point of view.

 

Discuss.  Do LAs need to get with the times?

Edited April 4, 2025 by PotNoodleTech

[Olliedawg]

It would be much easier if they allowed "co management" of the firewall, with senior techs/network managers for example

[Primus]

I'm surprised that many schools are still using an LA connection to be honest.

[drutt]

We took our firewall and broadband in-house back in 2019, before that we were using LEA firewalling, filtering and broadband. It feels like we're much more secure now and more able to quickly adapt to changes in the security environment than before.

 

Also their AV solution was McAfee 🤮

Edited April 4, 2025 by cnewstead

[garethEds]

We asked about eSports the other year and was told that the PSBA was not designed to be an eSports suitable broadband connection. Interesting really as they allow Minecraft to be used as an eSports game. Since then I know our Adviser has been looking into things but nothing has happened.

 

Gareth

[psydii]

What seems to be the problem (on a technical level) with LA-class filtering/firewall and esports? 
 

If it’s that they won’t allow UDP any-any rules, it’s not an  LA/RBC problem, it’s that a local network manager isn’t a full time network/security analyst and might not fully understand/appreciatethe risks involved in opening things up so wide. Don’t forget LA/RBC firewalls and their administrators have a much broader perspective on the harm that can come from such open rules. 
 

if it’s that they won’t open up for *specific* endpoints, or urls, or filter by internal user…. Again that’s hard (and expensive) at scale, but should be do-able in 2025.

 

we’re in LGfL and there are a couple

of PlayStations on site that have their own rule sets/policies, and seem to work just fine. There are quite a few “moving parts” to make it work, but we are able to have rules for those specific devices do

not compromise the rest of the network.

 

perhaps it helps we have our own internal

ip range, dhcp scopes, swtich/router access control list, and firewall behind the LA/RBC managed IP range….

…but in a even simple LA/RBC managed environment, you ought at least to be able to have specific IPs allocated to specific devices from which esports is to be allowed, and perhaps even have time based rules too? Pretty sure this was possible/normal 20

years ago! 

[PotNoodleTech]

The irony though Gareth is that WG are pimping e-sports left right and centre and have even set up an e-sports in school quango for all the schools that still can't do e-sports becaue local authorities are inept.

 

I did almost post on every welsh gov esports tweet but that would probably get me sacked.

[pete]

Is there any evidence the Welsh government has provided funding for any additional work (bandwidth, latency, IPAM and firewall rules for several thousand additional devices) at the LA/RBC/Service Provider level necessary to support their eSports strategy?

 

....because if they haven't, and it's out of scope for the current contract......<insert Mike Monteiro's most infamous presentation>

[mikes]

Yeah we had Minecraft Classroom set up so the kids could join eachothers worlds, but a LEA firewall/switch (they do our internal switches) has stopped them joining eachothers worlds.

 

They do say it is a fault (they didn't block any internal ports) and are working with me to fix it but it's difficult to do troubleshooting etc when you have no access to the switch/firewalls at all. 

 

We are forced to use our LEA's switches etc it seems in Wales (or at least our area) we are all on a giant network with all the other schools and are allocated an IP range to use with our servers. The LEA does a lot more for some other schools who have had trouble getting IT staff e.g. running their DC's etc.

 

There are pros and cons to it, pros being another group of eyes looking over the firewall, IDS etc. But the cons being troubleshooting, you are very limited and if they say "the port is open" yet something isn't working it can be very difficult!

[psydii]

No experience of Wales, but when dealing with a black-box system supported by others, I have found Wireshark captures to be my ally here. "I'm not really a Wireshark expert, but this seems to show packets leaving and never getting a reply..."  or "All that red for traffic to those IPs doesn't seem right to me?"  have both got my tickets escalated to someone with the skills to figure out where the problem lay.

[ITGuyNW]

On 04/04/2025 at 12:29, Primus said:

I'm surprised that many schools are still using an LA connection to be honest.

I'm trying to move away from ours at the moment but as its not in my name, its hard convincing the right people.

[PotNoodleTech]

32 minutes ago, ITGuyNW said:

I'm trying to move away from ours at the moment but as its not in my name, its hard convincing the right people.

In Wales, pretty much all schools are using LA/PSBA