Why does my internet suck? Smart Queues

Since the firewall has smart queue rules, it’s time to set them up. Firstly, let’s thank firewall people from getting around to adding domain based rules. Secondly, thumbs down on providers who don’t disclose their purposed based domains names.

First step, go find all the ports for the services you rely on. I vaguely recall that streaming services are all over UDP. Because nobody wants to do all the TCP handshakes. So when setting up my rules, i’ll just allocate the UDP connections to the HIGH Priority smart queue.

Second step, create the rules you want. For my setup, I had to go through and create up individual smart rules as to give priority to these endpoints or specific ports. I did manage to set up some network segmentation, so the rules are only scoped to the primary vlan that my phones, laptops, and tablets use. Wish firewalla managed a list or enabled a community defined list, so I wouldn’t have to hunt these all down.

Zoom

(Zoom Firewall Ports)[https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0060548]

Google Meet

(Google Meet Firewall Ports)[https://support.google.com/a/answer/1279090?hl=en]

• For audio and video, set up outbound UDP ports 3478 and 19302​–19309.
  • If you want to limit the number of Chrome WebRTC ports being used, use the ports specified at WebRTC UDP Ports . 
  • Or, you can limit those ports with your firewall.
• stream.meet.google.com
• youtube.googleapis.com
• www.youtube-nocookie.com
• googlevideo.com

Slack Huddles (aka Amazon Chime)

• Check that your network is set up to allow outbound traffic to UDP/22466. Otherwise, huddles will use TCP/443 for media transport (video and audio).
• Allow outbound traffic to TCP/443. This is required for huddles to function, even if outbound traffic to UDP/22466 is allowed for media transport.
• If you’d like, you can limit access to a specific IP range: 99.77.128.0/18. If your environment requires you to allow Slack’s required domains , make sure you approve *.m.chime.aws. We aren’t able to provide a list of static domains, and suggest allowing by wildcard to avoid any network disruptions.

^ That’s because they don’t manage the service… https://cloud-native.slack.com/help/urls

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

  [
    "*.chime.aws",
    "a.slack-edge.com",
    "a.slack-imgs.com",
    "admin.slack.com",
    "alpha.slack.com",
    "api.slack.com",
    "app.slack.com",
    "assets.slack.com",
    "avatars.slack-edge.com",
    "b.slack-edge.com",
    "b.slack-imgs.com",
    "beta.slack.com",
    "blog.slack.com",
    "ca.slack-edge.com",
    "cloud-native.slack.com",
    "downloads.slack-edge.com",
    "edgeapi.slack.com",
    "email.slack.com",
    "email2.slack.com",
    "email3.slack.com",
    "email4.slack.com",
    "emoji.slack-edge.com",
    "example.slack.com",
    "files-edge.slack.com",
    "files-origin.slack.com",
    "files.slack.com",
    "global-upload-edge.slack.com",
    "go-beta.slack.com",
    "go-debug.slack.com",
    "go.slack.com",
    "help.slack.com",
    "hooks.slack.com",
    "join.slack.com",
    "my.slack.com",
    "oauth2.slack.com",
    "platform-tls-client.slack.com",
    "platform.slack-edge.com",
    "slack-email.slack.com",
    "slack-files.com",
    "slack-imgs.com",
    "slack-infra-canvas.slack.com",
    "slack-infra.slack.com",
    "slack.com",
    "slack.global.ssl.fastly.net",
    "slackb.com",
    "spellcheck.slack-edge.com",
    "status.slack.com",
    "try.slack.com",
    "universal-upload-edge.slack.com",
    "upload.slack.com",
    "wss-backup.slack.com",
    "wss-mobile.slack.com",
    "wss-primary.slack.com"
]

Looks like they use chime under the hood for their “huddles”. So lets get the correct information for the

https://docs.aws.amazon.com/chime/latest/ag/network-config.html https://answers.chime.aws/articles/123/hosts-ports-and-protocols-needed-for-amazon-chime.html

• Amazon Chime Meetings, Chat, and Business Calling uses 99.77.128.0/18 TCP/443 UDP/3478

MS Teams

Of course this would be black hole of vague redirects to find the actual information. What a shitshow MS. Also, wish I could just set a domain fore these fools. https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

Skype for Business Online and Microsoft Teams

Apple

https://support.apple.com/en-us/HT202944 https://support.apple.com/en-us/102036

I do a bunch of RDP to headless machines, so need to give those ports some priority.