Vodacom APN outgoing ports

[rob_sa]

Hi All,

I have application needs to communicate on a couple of UDP ports: 20500 and 20510 (one of these is definately fixed and cannot be changed)

In my testing, these ports are currently open and working on a standard pre-paid sim with standard APN. This allows me to also send back a response from my server. My question is, are all ports unblocked outgoing and will they stay unblocked?

I don't want to have to move over to the unrestricted APN due to the admin-overhead of filling in and faxing/scanning the request forms etc. Potentially I will have 100's or 1000's of different "users" which need to connect to the server and receive replies. It would be ideal to keep the sim-cards as pre-paid and not having to go via a private APN or even the unrestricted one for that matter.

Am I also correct in assuming that whilst the unrestricted APN allows incoming traffic to initiate the request, there is no way to prevent someone port-scanning you and therefore fleecing all the data? Something like a DDoS but in this case a DDoC (Distributed denial of Credit/eh-tyme)!

Is there any definitive policy/literature from Vodacom about this as I am hesitant to model my application on this basis if in future they do start blocking outgoing ports?

Also for completeness I would appreciate comments regarding the same provisions with other operators in South Africa.

Many thanks in advance,

Rob.

 

[Franna]

The outgoing request punches a hole through the firewall to accept a reply. Otherwise how will HTTP browsing work if a client can request a website but not receive the response.

Answer: No outgoing ports are blocked and will never be. So don't worry about unrestricted APNs etc. The client must just initiate the connection over any port.

Is this for Teamware Office, because it looks like TCP and not UDP.
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

 

[VodacomData]

Am I also correct in assuming that whilst the unrestricted APN allows incoming traffic to initiate the request, there is no way to prevent someone port-scanning you and therefore fleecing all the data? Something like a DDoS but in this case a DDoC (Distributed denial of Credit/eh-tyme)!

Is there any definitive policy/literature from Vodacom about this as I am hesitant to model my application on this basis if in future they do start blocking outgoing ports?

Hence the need for the form to be filled out. We cannot accept any responsibility on how you setup/run your service.

Only unrestricted apn will allow the access that you are referring to.

Regards
Vodacomdata

 

[rob_sa]

Is this for Teamware Office, because it looks like TCP and not UDP.
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Hi Franna,

Many thanks for your reply. Good to know that I can initiate over any port and receive appropriate replies.
In answer to your question it is not Teamware as that's in the 25000 range - I'm needing 20500 - it's definately UDP and it's for GPS&GSM tracking devices supplied by a company called Cal Amp from the states.

Thanks,

R.

 

[jannievanzyl]

As posted above, outgoing ports are open.

But please make sure you don't use a port that's well-known for another application in your own setup. The in-line engines are clever nowadays and will look at how a specific port behaves and if it is not the expected behaviour for that port, might kill the session, suspecting some malicious intent.

(Had a guy using 21 recently for his financial app and he could not understand the erratic connections he was getting. But the firewalls were going ape-**** thinking it's someone trying to hack FTP servers.)

While UDP/20500 is not well-known, I see COD uses it. not sure how relevant that is.

You should always try and pick an obscure number as peeps tend to go for nice, clean numbers. No-one will probably use 19753, for example.

 

[rob_sa]

@Jannievanzyl

Many thanks for your valuable input.
Yes I have control over the one port which will be the main communication port however the other which would/might occasionally be used for OTA updates I believe I cannot change.

Thanks again,

R.