What Ports Are Used by a Web Application Firewall?

Web Application Firewalls (WAFs) typically use standard ports like 80 for HTTP and 443 for HTTPS to protect web traffic. Many WAFs also support alternative ports such as 8080 and 8443, commonly used in development or specialized services. Commercial providers like GoDaddy add ports linked to hosting panels, including 2082 and 2083. Vendors such as Alibaba Cloud, Huawei Cloud, and Tencent Cloud extend support to a wide range of non-standard ports depending on editions and deployment types, but exclude system or reserved ports like SSH or SMTP for security reasons. Configuring the right ports per vendor is important for effective protection and smooth application operation.

Standard Ports Used by Web Application Firewalls

Web Application Firewalls (WAFs) primarily focus on monitoring traffic on ports 80 and 443, which serve as the foundation for most web application protection. Port 80 handles unencrypted HTTP traffic, allowing WAFs to inspect and filter incoming requests in plain text. Port 443, on the other hand, carries encrypted HTTPS traffic secured by SSL/TLS, and WAFs are designed to decrypt, inspect, and protect this traffic as well. These two ports cover the vast majority of web application traffic, making their support essential for any effective WAF deployment. WAFs analyze headers, cookies, and payloads on these ports to identify and block malicious activity, often sitting inline to proxy or route traffic through their systems. Additionally, port 80 traffic is frequently redirected to port 443 after inspection to enforce secure connections, while session persistence and SSL offloading typically happen on port 443 within WAF configurations. Most WAF management interfaces and default rule sets assume these ports as primary, ensuring backward compatibility with both HTTP-only and HTTPS-enabled applications.

Common Alternative and Extended Ports for WAFs

Ports 8080 and 8443 are widely recognized as common alternative ports for HTTP and HTTPS traffic, respectively, and are supported by many major WAF vendors such as Tencent, Alibaba, GoDaddy, and Huawei. These ports help avoid conflicts with standard ports 80 and 443, allowing web applications to run in development, testing, or specialized environments without interruption. WAFs extend their protection to these alternative ports by applying the same or similar security rulesets they use for the standard ports, ensuring consistent inspection and threat mitigation across different deployment scenarios. Cloud providers frequently offer flexibility to users, enabling them to assign ports like 8080 and 8443 to their applications behind WAFs, which is particularly useful for legacy systems or custom architectures. Although traffic on these ports tends to be less common, it still requires thorough inspection to prevent attackers from bypassing security controls. Many WAFs allow administrators to customize policies on a per-port basis, adapting protections to the specific protocols or risk levels associated with each port. In some cases, fallback mechanisms redirect or proxy traffic from these non-standard ports back to standard ones, providing a uniform security posture and simplifying policy enforcement.

Additional Ports Supported by Commercial WAF Providers

Commercial WAF providers often support a range of additional ports beyond the standard HTTP (80) and HTTPS (443) to accommodate hosting control panels and webmail services. For example, GoDaddy lists several HTTP ports, including 2052, 2082, 2095, 8080, and 8880, which are commonly used for interfaces like cPanel and Plesk. Corresponding HTTPS ports such as 2053, 2083, 2096, and 8443 enable secure access to services like Webmail and WHM. Ports 2086 (HTTP) and 2087 (HTTPS) are also supported, mainly for WHM management panels behind the WAF. These ports allow hosting providers to offer web-based control panels and mail access while routing traffic through the WAF for security inspection. Because these ports are critical for administrative and mail functions, WAFs must be carefully configured to avoid blocking legitimate traffic. This often involves specialized rule sets or exceptions tailored to control panel traffic to prevent service disruptions. Supporting these ports highlights the need for WAFs to handle diverse service endpoints beyond standard web traffic, ensuring seamless protection without interrupting essential hosting operations.

Non-Standard and Custom Port Support by WAFs

Many Web Application Firewalls (WAFs) go beyond the default HTTP and HTTPS ports by supporting non-standard and custom ports to address the needs of diverse web environments. Alibaba Cloud, for example, offers a very broad port range from 0 to 65535 but restricts critical system ports like 22 (SSH), 25 (SMTP), 3306 (MySQL), and 3389 (RDP) to avoid conflicts and security risks. The number of additional ports allowed typically depends on the subscription tier, with Enterprise and Ultimate editions permitting between 50 and 100 extra ports. Huawei Cloud supports an extensive list of non-standard HTTP and HTTPS ports such as 81, 82, 83, 800, 8888, 9001, 9443, 9999, 10000, 18000, and 28080. This support varies by edition (Standard, Professional, Enterprise) and deployment mode (Cloud or Dedicated), reflecting the flexibility needed for different use cases. Tencent Cloud also enables custom port configuration, allowing protection for web applications running on any user-defined port, which is useful for specialized APIs or internal services exposed externally. WAF providers generally exclude ports tied to critical system services to reduce attack surfaces and prevent interference with essential network functions. Using custom ports behind a WAF requires careful configuration to ensure traffic is routed correctly and security policies are applied as intended. The ability to specify and protect non-standard ports is especially valuable in hybrid cloud setups or environments with multiple applications having diverse traffic demands. However, this flexibility often involves additional licensing or configuration complexity depending on the vendor and subscription level. For organizations running specialized web services or internal applications on uncommon ports, this extended port support is crucial for maintaining consistent security coverage across all web-facing endpoints.

Security Restrictions on Certain Ports

Web Application Firewalls (WAFs) commonly block or exclude system and reserved ports such as FTP (20, 21), SSH (22), SMTP (25), DNS (53), and RDP (3389). These ports run non-HTTP protocols that WAFs are not built to inspect, so allowing traffic through them could lead to misuse or conflicts. For example, FTP and SSH are protocols unrelated to web traffic, so passing them through a WAF offers no protection and may introduce security gaps. Additionally, ports like 3306 (MySQL) and 6379 (Redis) are often restricted because database protocols are incompatible with WAF inspection methods. By blocking these ports, WAFs reduce the risk of lateral movement within the network and prevent attackers from exploiting system services via the WAF. Traffic destined for unsupported or restricted ports is typically denied or dropped by default unless explicitly allowed by policy. Instead, security controls for these ports are usually managed by dedicated firewalls or network security tools better suited for their protocols. Some WAF vendors maintain detailed and regularly updated exclusion lists to keep pace with evolving threats and protocol changes. Applications requiring communication on restricted ports must bypass the WAF or implement alternative solutions, such as proxying through supported ports or direct origin access. Misconfigurations that accidentally permit traffic on these restricted ports can expose systems to attacks that bypass WAF protections entirely. For this reason, vendors recommend careful port management and thorough documentation of which ports are allowed or blocked to maintain a strong security posture.

• Many WAF providers block or exclude system and reserved ports such as FTP (20, 21), SSH (22), SMTP (25), DNS (53), and RDP (3389) to prevent misuse and conflicts.
• These ports are often excluded because they run non-HTTP protocols that WAFs are not designed to inspect.
• Blocking restricted ports helps minimize the risk of lateral movement and exploitation of system services through the WAF.
• Ports like 3306 (MySQL) and 6379 (Redis) are also commonly restricted due to database protocol incompatibility with WAF inspection.
• Traffic sent to unsupported ports through a WAF is typically denied or dropped by default unless explicitly allowed.
• Security policies on these ports are often handled by dedicated firewall or network security devices instead of the WAF.
• Some vendors maintain detailed exclusion lists that are updated regularly to reflect emerging threats and protocol changes.
• Applications running on restricted ports must bypass the WAF or use alternative mechanisms to ensure availability.
• Configuration errors allowing traffic on restricted ports can expose systems to attacks that bypass WAF protections.
• Vendors recommend careful port management and clear documentation of allowed and blocked ports to maintain security posture.

How WAFs Handle Unsupported Ports?

When a Web Application Firewall (WAF) encounters traffic on an unsupported port, it usually blocks or rejects the connection to prevent unmonitored access. This is important because unsupported ports bypass the WAF’s inspection and logging, leaving the application vulnerable to attacks. If traffic is routed through the WAF on an unsupported port without proper setup, it can lead to connection failures or even service interruptions. To work around this, administrators often proxy application traffic through standard supported ports like 80 or 443, ensuring the WAF can properly inspect and log all requests. Another common method is to use subdomains or DNS entries that point directly to the origin server, bypassing the WAF for these unsupported ports. However, this approach increases risk since traffic flows without filtering. Some WAF solutions allow admins to request support for additional ports via vendor channels or configuration changes, but this varies by vendor and deployment type. Cloud-based WAFs tend to enforce stricter port limitations compared to dedicated appliances. Proper network design and clear routing policies help prevent unsupported ports from circumventing security controls. Most WAF management interfaces provide alerts or warnings when traffic attempts to reach unsupported ports, aiding in operational awareness. Documenting these unsupported ports and any user workarounds is crucial for risk assessment and maintaining security hygiene.

Summary of Ports Supported Across Major Vendors

Web Application Firewalls (WAFs) universally support standard HTTP ports like 80 and 8080 for unencrypted traffic, and HTTPS ports 443 and 8443 for encrypted traffic. These remain the core ports for web application protection across all major providers. Beyond these, some vendors, such as GoDaddy, extend support to a range of hosting control panel ports, including 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, and 8880, to secure administrative and mail interfaces commonly used in hosting environments. Support for non-standard ports varies significantly by vendor and often depends on the subscription tier or deployment mode. For example, Alibaba Cloud and Huawei Cloud offer extensive coverage across broad port ranges, excluding system-reserved ports like 22 (SSH), 25 (SMTP), 53 (DNS), 3306 (MySQL), and others, which are generally blocked to prevent security risks and protocol conflicts. It’s important to note that unsupported ports may require workarounds such as proxying through standard ports or bypassing the WAF for those specific services. Vendors typically provide detailed documentation listing supported and restricted ports, which assists administrators in effective configuration and compliance. Because port support can differ across cloud and dedicated deployments, organizations should carefully verify compatibility with their chosen WAF to ensure coverage matches their application architecture. Tables summarizing port support can be especially helpful for quickly identifying which ports are protected and planning secure environments accordingly.

Vendor-Specific Port Support Details

Web Application Firewall (WAF) port support varies notably among vendors, reflecting their target use cases and customer needs. GoDaddy centers its WAF port support on commonly used web and hosting control panel ports. This includes both HTTP and HTTPS versions of ports tied to popular hosting platforms like cPanel, WHM, Webmail, and Plesk. For example, GoDaddy’s WAF supports ports such as 2082 and 2083 for cPanel, 2095 and 2096 for Webmail, and 8880 and 8443 for Plesk, aligning with typical hosting environments and simplifying integration.

Tencent Cloud takes a more flexible approach, allowing users to configure custom HTTP and HTTPS ports. This flexibility suits diverse application architectures, including microservices and API gateways where services often run on non-standard ports. By supporting user-defined ports, Tencent Cloud’s WAF can protect a wide range of web services without forcing traffic through default ports.

Alibaba Cloud offers broad port range support with tiered subscription limits. Their WAF excludes critical system and reserved ports like 22 (SSH), 25 (SMTP), 3306 (MySQL), and 3389 (RDP) for security reasons, but otherwise supports a wide spectrum of ports across the 0-65535 range. Higher-tier subscriptions unlock support for more non-standard ports, which benefits enterprises running complex multi-service applications on unconventional ports.

Huawei Cloud provides extensive support for non-standard ports, with variations based on the WAF edition (Standard, Professional, Enterprise) and deployment mode (Cloud or Dedicated). They maintain detailed documentation listing hundreds of supported ports, including uncommon ones such as 81, 8888, 9443, and many others. This granularity allows customers to select the best fit for their deployment scenario, whether cloud-native or dedicated hardware.

Given these vendor-specific differences, it is important to carefully review documentation before implementing WAF policies or routing traffic. Misunderstanding port support can lead to configuration errors or unprotected traffic paths. For instance, trying to protect an application running on a port unsupported by a vendor’s WAF may require workarounds like proxying traffic through supported ports or bypassing the WAF for that service.

In short, knowing the nuances of each vendor’s port support helps ensure the WAF is fully effective in protecting web applications and minimizes the risk of exposure due to unsupported or misconfigured ports.

Frequently Asked Questions

1. Which network ports do web application firewalls commonly use for monitoring web traffic?

Web application firewalls (WAFs) typically monitor network traffic on ports 80 and 443, which handle HTTP and HTTPS traffic, respectively. These ports are essential because they carry most web application data.

2. How does a web application firewall use ports differently in a reverse proxy setup?

In a reverse proxy setup, the WAF usually listens on a port facing the internet, often port 443 for HTTPS, and forwards traffic to the web server on internal ports like 80 or 8080. This helps the WAF inspect and filter requests before they reach the application.

3. Can a web application firewall be configured to work on non-standard ports? If yes, why would that be necessary?

Yes, WAFs can be configured to operate on custom or non-standard ports if your web application uses them. This is useful when services run on alternative ports for security through obscurity or specific architectural reasons.

4. What role do ports play in integrating a web application firewall with APIs or cloud services?

When integrating WAFs with APIs or cloud platforms, certain ports corresponding to API endpoints must be open, often on 443 for secure connections. Proper port configuration ensures the WAF can inspect and protect API traffic effectively.

5. Are there specific ports a web application firewall uses for management and administrative access?

Yes, many WAFs use separate ports for management interfaces, commonly TCP ports like 8080 or 8443. These allow administrators to configure the firewall without interfering with regular web traffic on standard ports.

TL;DR Web Application Firewalls (WAFs) primarily use standard ports 80 (HTTP) and 443 (HTTPS) to monitor web traffic. Many also support common alternative ports like 8080 and 8443, along with additional hosting control panel ports such as those used by cPanel and Plesk. Commercial WAF providers like Alibaba Cloud, Huawei Cloud, Tencent Cloud, and GoDaddy offer broad support for non-standard ports depending on the edition and deployment. However, certain system and reserved ports are typically restricted for security reasons. When unsupported ports are needed, proxying traffic through standard ones or bypassing the WAF with direct origin IP mapping are common solutions. Overall, port support varies by vendor and product tier, making it important to understand specific capabilities for effective WAF deployment.

Resource URL:

https://en.wikipedia.org/wiki/Web_application_firewall

https://www.edgenexus.io/products/web-application-firewall/