大多数防火墙默认配置是否允许与 HTTPS 相同的安全 TCP？
我需要实现从客户端到服务器的安全数据传输（二进制数据）。我正在寻找不需要客户端配置防火墙例外的解决方案。
显而易见的选择是 HTTPS。大多数防火墙默认允许传出 HTTPS。 HTTPS 有两个问题：
我不想实现 HTTPS（即使是最简单的版本），因为我不需要它的复杂性。简单的自定义安全二进制协议就足够了。
我想避免将二进制数据放入 HTTP POST 消息所需的 base64 编码的开销（如果我错了，请纠正我）。客户端在弱硬件（嵌入式系统）上运行。
现在，我的假设。由于 HTTPS 是加密的（根据定义），防火墙无法解析它或检查数据是否是 base64 编码的。这意味着我可以使用我的自定义 TCP 安全协议（使用 HTTPS 端口 (443)）来模拟 HTTPS，并且防火墙将无法将其与 HTTPS 区分开来。请确认或解释我的错误是什么。
I need to implement secure data transfer from client to server (binary data). I'm looking for the solution that doesn't require clients to configure firewall exceptions.
Obvious choice is HTTPS. Most firewalls allow outgoing HTTPS by default. There're two issues with HTTPS:
I don't want to implement HTTPS (even the simplest possible version) because I don't need its complexity. Simple custom secure binary protocol would be enough.
I'd like to avoid overhead of base64 encoding required for binary data to be put into HTTP POST message (please correct me if I'm wrong). Client runs on weak hardware (embedded system).
Now, my assumptions. Since HTTPS is encrypted (by definition), firewall cannot parse it or check if data is base64 encoded. This means I can use my custom TCP secured protocol using HTTPS port (443) to imitate HTTPS and firewall won't be able to distinguish it from HTTPS. Please confirm or explain what's my mistake.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在我看来，防火墙并不是一个真正好的防火墙，除非“默认”配置是拒绝所有进/出（例如，Juniper SRX 和 Cisco ASA 默认情况下就是这样做的）。 最常见的防火墙配置通常允许 HTTPS 通过。
至于构建您自己的自定义协议，出于对披萨的热爱（以及您自己的理智），请使用现有的许多标准化文件传输协议之一......选择是开放的，例如 ftp 、
rsync、http（见下文）、scp和sftp。您需要考虑两件事...
IMO a firewall is not really a good firewall, unless the "default" configuration is to deny everything in/out (for instance, this is what a Juniper SRX and Cisco ASA do by default). The most common firewall configurations typically allow HTTPS through.
As for building your own custom protocol, please for the love of pizza (and your own sanity) use one of the many standardized file transfer protocols that already exist... the choices are wide open, such as
ftp,rsync,http(see below),scp, andsftp.Two things you need to think about...