Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm a network administrator at a small college. In the past, we've kept a fairly open wireless network, but recently a few throughput issue have made us consider locking it down a bit more, in a play we predict will potentially preserve packet-passing performance for peers. Students would still be able to do almost anything over the wired connection available in each room, but the wireless would for the first time require authentication and be limited to only certain ports. Currently we're considering 53(dns), 80 & 443(web), 143, 587, 993, and 995 (email), and 1935 (flash video).

The big issue here for us is that we also give each new full-time on-campus student an iPod Touch, and so we need to make sure these devices (which are wireless only) continue to work for our students as expected. So can anyone share any iOS apps or services that use other ports that we would need to open? For example, if iTunes purchases, Location Services, Push Notifications, FaceTime, or certain well known apps require other ports, which apps and what ports do they use?

The main push behind this is density in the dorms: at certain times of day we just have too many radios active in too small a space at one time, and throughput really suffers. So the idea is to force certain traffic (especially games and torrents) to the wired connections, which can handle this much better, and thus leave the air waves more open for other devices that don't need this capability. So this is about making things work better rather than being more restrictive just because we can.

Note that this will all probably come to nothing, but I do need to at least investigate it thoroughly.

share|improve this question
    
The last Campus Party here in Brazil, which had over 10k people in a small space sharing an announced 10gbps internet, took a very similar route. No wifi at all. They knew the routers wouldn't be able to handle it after the CP in 2010, which practically burned and broke a few of them. So, yes, this is a very valid problem. But I'd still hope for a better solution... –  Cawas Feb 19 '11 at 12:24
add comment

4 Answers

up vote 4 down vote accepted

Have a look at the ports commonly used by Apple (on all devices, not only iOS) here (Though these are only the ones used by Apple and other Developers might use other ports) and look for specific Services (FaceTime uses many ports, so does Game Center and so on…)

share|improve this answer
add comment

This is a bit off topic but have you considered traffic shaping instead of completely blocking ports.
If you limit the bandwidth lets say after a certain MB downloaded or uploaded via WiFi in a given period of time the students would soon figure out that they are better of using the wired network for their bandwidth intensive tasks.
As you have suggested in your question blocking ports would be an endless wack-a-mole game of user complains and port openings and if a new popular app comes along or Apple changes something in iOS (like Game Center) then you would have to re-analyze your firewall settings every time.

share|improve this answer
    
Our current gateway software only has very limited support for traffic shaping, and I still want to allow certain bandwidth intensive items like netflix/youtube. –  Joel Coehoorn Feb 18 '11 at 20:17
add comment

As a sys admin, you would most likely want port 22 open in order to be able to use an iPod Touch SSH app.

share|improve this answer
    
Not really - this is only for traffic going from our on-campus wireless to the off-campus internet. I might on rare occasions want that, but I hardly need it. –  Joel Coehoorn Feb 18 '11 at 20:14
add comment

Cutting down peer-to-peer traffic is not an easy thing to do. Most of torrent clients support encryption and dynamic port assignment. Since it's hard to cut the crap from invading your network, you can easily make a pirate's life a nightmare by adding some basic traffic rules.

Install a firewall (any Ubuntu box with two Ethernet ports will do it) and set a rule to limit the number of simultaneous connections from a single peer.

Torrent clients gain speed by establishing multiple connections to a pool of seeders. By limiting the number of possible connections you'll make sure that none of your young guns' will be able to download faster than 15-20 kb/sec, which should be enough to release the pressure on your WiFi and discourage users from using WiFi connections to do their nasty stuff.

I won't go through technical stuff here. Just Google it: Ubuntu gateway firewall rules, etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.