使用HTTP端口绕过防火墙
我正在创建一个通过自定义套接字协议进行通信的客户端-服务器应用程序。我希望客户端能够在具有限制性防火墙的网络（公司、学校等）内使用。通常这是通过 HTTP 连接来完成的，因为它始终可用。
如果我想这样做，我真的必须使用 HTTP 还是通过服务器端口 80 使用我的自定义协议就足够了？
I'm creating a client-server application which communicates via a custom socket protocol. I'd like the client to be usable from within networks that have a restrictive firewall (corporate, school, etc.). Usually this is done by connecting via HTTP, since that's always available.
If I want to do that, do I really have to use HTTP or is it enough to use my custom protocol via server port 80?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
防火墙可能有更多的限制检查，而不仅仅是限制端口，而且您可能还拥有代理，它们将处理 HTTP。
尽管如此，将众所周知的端口用于正常用途之外的其他用途仍然比许多方案要好得多，这些方案通过 HTTP 执行本质上非 HTTP 的内容，并且本质上实现了 RFC 3093（当人们实现愚人节 RFC 时，它通常会显示一个组合）幽默和技术敏锐，RFC 3093 是例外）。
要解决代理问题，您可以使用 443 而不是 80，因为 HTTPS 流量无法以完全相同的方式进行代理。事实上，您通常甚至不需要使用 SSL，因为代理会假设他们看不到它。
不过，您的应用程序不需要完成这些操作。您的应用程序需要做的是使其端口可配置（无论如何，任何服务器应用程序都应该这样做）。默认值应该远离众所周知的端口，但系统管理员将能够使用 80 或 443 或任何他们需要的端口。
The firewall may have more restricted checks than just restricting ports, and you might also have proxies along the way, and they will deal in HTTP.
Still, using a well-known port for something other than its normal use is still far better than so many schemes which do inherently non-HTTP stuff over HTTP, and essentially implement RFC 3093 (when people implement April Fools RFCs it normally shows a combination of humour and technical acumen, RFC 3093 is the exception).
To get around the proxy issue, you could use 443 rather than 80, as HTTPS traffic can't be proxied in quite the same way. Indeed, you often don't even need to use SSL, as the proxy will just assume that they can't see it.
None of this needs to be done with your application though. What your application needs to do is to have its port be configurable (that should be done with any server application anyway). The default should be something away from well-known ports, but the sysadmin will be able to use 80 or 443 or whatever if they need to.
如果它是自定义套接字协议，那么它就不是 HTTP。
但是您仍然可以在端口 80 上使用 TCP 来逃避防火墙，但随后您还必须处理代理情况。代理支持 HTTP，自定义 TCP 可能不起作用，并且它们可能不会转发您的请求。
我不知道你想这样做的原因（如果合法或不合法），但有一些软件可以用来绕过伊朗等国家的过滤。其中一款软件（Haystack）使用复杂的加密技术将请求伪装成看似无辜的数据包。
If it is a custom socket protocol then it is not HTTP.
But you can still use TCP on port 80 to escape the firewall but then you would have to handle the proxy situation as well. Proxies are HTTP aware and custom TCP might not work and they probably would not forward your requests.
I do not know about the reasons you want to do this (if it is legal or not) but there are software that are used to bypass the filtering in countries such as Iran. One of the softwares (Haystack) uses a sophisticated encryption to masquerade the request as an innocent looking packet.
您最好研究一下 SSH 隧道技术。它正是为此而设计的。由于多种原因（包括其他答案中给出的原因），HTTP 代理不太可能起作用。
You would be better off investigating tunneling with SSH. It is designed for precisely this. An HTTP proxy isn't likely to work for a number of reasons including those given in the other answers.