What does a Firewall need to enable proper lichess usage? • page 1/1 • Off-Topic Discussion • lichess.org

On my Linux machine, lichess behaves well. My best chess-friend is using Windows 10, which is unfamiliar to me. I just witnessed lots of broken functionality (like messages/posts not reaching the server, game playing not possible, not even against comp, and more). Obviously, he can connect with password, but many things are not working. We checked: If he uses his account on my box, it does work fine. His internet looks fine at first glance. His firewall setting looked overwhelming to me ... meaning: It looks like nothing is permitted, only about 200 rules allow certain uses. Of course, lichess was not among those.

Apparently, Microsoft support made that configuration and the result is, that his firewall is quite possibly the culprit here. OTOH, i have not been able to find the settings necessary (TCP/UDP ports to open for lichess to work).

So this is my request: Could anyone knowledgeable hint us towards a solution? My friend does not speak english, that is why i am asking on his behalf. We would love to play online during corona shutdown.

On my Linux machine, lichess behaves well. My best chess-friend is using Windows 10, which is unfamiliar to me. I just witnessed lots of broken functionality (like messages/posts not reaching the server, game playing not possible, not even against comp, and more). Obviously, he can connect with password, but many things are not working. We checked: If he uses his account on my box, it does work fine. His internet looks fine at first glance. His firewall setting looked overwhelming to me ... meaning: It looks like nothing is permitted, only about 200 rules allow certain uses. Of course, lichess was not among those. Apparently, Microsoft support made that configuration and the result is, that his firewall is quite possibly the culprit here. OTOH, i have not been able to find the settings necessary (TCP/UDP ports to open for lichess to work). So this is my request: Could anyone knowledgeable hint us towards a solution? My friend does not speak english, that is why i am asking on his behalf. We would love to play online during corona shutdown.

laatikko

#2

You mean Windows' own firewall, Windows Defender?

SlowSlug

#3

@laatikko : yes, sorry, that is what i meant

laatikko

#4

I tried lichess with win10 (with windows defender) and there was no problem. Have you tried turning the win defender off?

SlowSlug

#5

my friend would not allow me to do this. he is not very much into computers and did pay microsoft for his security. otherwise, i#d have done that by now.

SlowSlug

#6

...thinking about this some more, my conclusion was this: To turn the forewall off could be sufficient for a check of the assumption, that the Defenser is in fact the culprit. But it would not be feasible to turn his security upside down. I am used to the concept of basically 2 different concepts to security:

Allow everything except for some knows malware (inviting unknown malware to breach security)
Forbid everything by default and allow only known services/applications to pass thru (i saw lots of unnessecary config for business applications NOT in even installed on his laptop. Of cours, this would force malware to use patterns common to known services like FTP for example)

Since he has the 2nd approach, i need some knowledge about the necessities or lichess to work. What are the TCP/UDP ports/port ranges used to connect between the client and the server? My own attempts at googling this turned up nothing. Has noone ever come across this issue? @thibault

...thinking about this some more, my conclusion was this: To turn the forewall off could be sufficient for a check of the assumption, that the Defenser is in fact the culprit. But it would not be feasible to turn his security upside down. I am used to the concept of basically 2 different concepts to security: 1. Allow everything except for some knows malware (inviting unknown malware to breach security) 2. Forbid everything by default and allow only known services/applications to pass thru (i saw lots of unnessecary config for business applications NOT in even installed on his laptop. Of cours, this would force malware to use patterns common to known services like FTP for example) Since he has the 2nd approach, i need some knowledge about the necessities or lichess to work. What are the TCP/UDP ports/port ranges used to connect between the client and the server? My own attempts at googling this turned up nothing. Has noone ever come across this issue? @thibault

Lukasel

edited

#7

Lichess uses WebSockets for real-time data transfer. Like normal HTTP/HTTPS this goes over TCP ports 80 or 443 which seem to be enabled, as otherwise your friend could not reach this site. Typicaly a firewall should not make a difference between HTTP and WebSockets and it definitly can't distingish them from HTTPS without being able to break the underlying SSL encryption. So if you can reach the page it is probably not the firewall.
That said, I came across the same or at least a similar problem when trying to access Lichess from my companys network. I can login and view the site, however I can't input moves. Unfortunately I don't know which configurations lead to this behavior.

You could try accessing other web pages using WebSockets to test whether this is the problem or not. Please note that I am just guessing here, but I hope it helps to isolate the underlying problem.

EDIT:
If it is indeed a problem with WebSockets, you could look for a setting in the firewall that closes a connection if it has been open for too long. Also you should check whether you are using a proxy server or VPN as they could termiate long lived connections as well.

Lichess uses WebSockets for real-time data transfer. Like normal HTTP/HTTPS this goes over TCP ports 80 or 443 which seem to be enabled, as otherwise your friend could not reach this site. Typicaly a firewall should not make a difference between HTTP and WebSockets and it definitly can't distingish them from HTTPS without being able to break the underlying SSL encryption. So if you can reach the page it is probably not the firewall. That said, I came across the same or at least a similar problem when trying to access Lichess from my companys network. I can login and view the site, however I can't input moves. Unfortunately I don't know which configurations lead to this behavior. You could try accessing other web pages using WebSockets to test whether this is the problem or not. Please note that I am just guessing here, but I hope it helps to isolate the underlying problem. EDIT: If it is indeed a problem with WebSockets, you could look for a setting in the firewall that closes a connection if it has been open for too long. Also you should check whether you are using a proxy server or VPN as they could termiate long lived connections as well.

SlowSlug

#8

@Lukasel
Thank you so much for this background information. If i understand your message correctly, my assumption about the Defender being in the way is bogus.
Ok. I will try to test another site with Websockets. Any suggestions there?
If that will indeed not be a problem, that'll leave me clueless.
But i'll tell him anyway, hopefully, we'll get to some sort of solution. :-)

@Lukasel Thank you so much for this background information. If i understand your message correctly, my assumption about the Defender being in the way is bogus. Ok. I will try to test another site with Websockets. Any suggestions there? If that will indeed not be a problem, that'll leave me clueless. But i'll tell him anyway, hopefully, we'll get to some sort of solution. :-)