No audio or video when connected to wifi in coworking space, no problems using hotspot

[robinkwilson]

From discord:
I was co-located with a few people in a co-working space. When we joined the (Hubs Cloud) room, pose data etc. was coming through, but no audio or video. Connecting to a phone based hotspot fixed the issue. I assume this is some strange firewall / port blocking issue? I did a search on git issues / discussions, but didn't turn anything up
We are able to make simple requests to the coworking space admin, who could potentially unblock the port (if that's what it is). Has anyone else had experience with something like this in a campus setting or similar?
Usually when I've had firewall issues it's been across the board, not affecting some things but letting others through

[robinkwilson]

We see this with company provided computers or educational institution provided computers and wifi.

From discord: https://discordapp.com/channels/498741086295031808/556170318474117150/691009024078118914
Is there a shared firewall in place or NAT going on between the machine and ISPs?
You need outgoing UDP ports open - 20000-65535
Hubs.mozilla.com has a narrower port range so if you have some higher udp ports blocked that would explain the difference
You also need outgoing 80 and 443 TCP
You can see the candidate ports tried and which failed via about:webrtc
When you connect, a random port is chosen to communicate over.

On custom hubs servers we actually do one more thing different - we run SSL websockets over port 80 given that we run Janus and reticulum on the same server, so any packet sniffing that may reject ssl encrypted packets on port 80 (which is non standard) could be problematic
Do they have a shared router? Maybe try putting one machine into the DMZ

[damienvancouver]

it's best practices in any properly managed network to block outbound port rnages in userland. It's completely unreasonable to require the ENTIRE userland port space be unblocked to use this technology, it is never going to fly in enterprise networks. The port range needs to be WAY smaller and configurable, or you need to have another means of whitelisting it that does not involve opening up the entire outbound port range (thereby opening one's network up to problems with malware, worms, ransomware, etc that is suddenly able to connect to C&C servers and join into a botnet, or opening one up to DCMA complaints when users at any large network open their laptop from home and it resumes uploading Game of Thrones ). Ignoring DMCA notices is not an option when following best practices either, so this "open up every port" solution is not really one that is going to fly.

What could work would be:

1. Proper documentation of how to whitelist just the servers needed for this port range (then it would not compromise the rest of a network's security)
2. a smaller, configurable port range (say 64000-65000) that could then reduce the risk of opening these ports.

[robinkwilson]

We certainly agree, it's a WIP.

Here's the issue for customizing the ports used on Hubs Cloud: Hubs-Foundation/hubs-cloud#90
Great idea on the documentation. Created an issue in Hubs Docs: Hubs-Foundation/hubs-docs#70