Server requires https but then uses http to communicate to speedtest

[marksie1988]

Hi There,

Just deployed the docker container and it was unable to communicate out of my network, I looked at my firewall logs and notice that the connection out to speedtest uses port 8080 instead of a secure connection.

Is there any way to change this?

[alexdelprete]

Hi,

1. The port number doesn't mean the protocol is secure/insecure, you can have a secure/insecure protocol on any port.
2. The connection to speedtest servers is managed by the embedded official ookla speedtest-cli, not by the app, and after it completes the test, it returns a json dataset to the app.
3. You can create a specific outbound rule for ST if you control outbound ports.
4. What does your firewall tell you about the protocol being used? The port is not important, the protocol information will give you more info.

[marksie1988]

1. Generally best practice says 8080 is not a secure port. I know that's not always the case but usually is for larger apps like speedtest.

2. I'm aware it's managed by the speedtest cli, however after looking into the code I see the --secure flag is not used. See: https://github.com/alexjustesen/speedtest-tracker/blob/main/app/Jobs/ExecSpeedtest.php#L39

3. I only allow secure outbound ports over my firewall.

4. I would need to do more digging to find that out as it's not logged in standard logging.

[alexjustesen]

1. Generally best practice says 8080 is not a secure port. I know that's not always the case but usually is for larger apps like speedtest.
2. I'm aware it's managed by the speedtest cli, however after looking into the code I see the --secure flag is not used. See: https://github.com/alexjustesen/speedtest-tracker/blob/main/app/Jobs/ExecSpeedtest.php#L39
3. I only allow secure outbound ports over my firewall.
4. I would need to do more digging to find that out as it's not logged in standard logging.

1. Correct 8080 is not a secure port, this is the default port for Okta's Speedtest CLI
2. --secure flag is not supported by their CLI, also sending random bits doesn't really need to be
3. your hour, your rules. when I add iperf support that might be a solution for you
4. 🪵 improvements are something that needs to be worked on

[alexdelprete]

1. Generally best practice says 8080 is not a secure port. I know that's not always the case but usually is for larger apps like speedtest.

The server port is not chosen by the app, but by the server. The port number has NOTHING to do with security, it's a port, the protocol used is secure/not secure, not the number of the port. This is networking 101.

2. I'm aware it's managed by the speedtest cli, however after looking into the code I see the --secure flag is not used. See: https://github.com/alexjustesen/speedtest-tracker/blob/main/app/Jobs/ExecSpeedtest.php#L39

Like I told you before, the app uses speedtest-cli by OOKLA, and their CLI tool does not have a --secure option:

Speedtest by Ookla is the official command line client for testing the speed and performance of your internet connection.

Version: speedtest 1.2.0.84

Usage: speedtest [<options>]
  -h, --help                        Print usage information
  -V, --version                     Print version number
  -L, --servers                     List nearest servers
  -s, --server-id=#                 Specify a server from the server list using its id
  -I, --interface=ARG               Attempt to bind to the specified interface when connecting to servers
  -i, --ip=ARG                      Attempt to bind to the specified IP address when connecting to servers
  -o, --host=ARG                    Specify a server, from the server list, using its host's fully qualified domain name
  -p, --progress=yes|no             Enable or disable progress bar (Note: only available for 'human-readable'
                                    or 'json' and defaults to yes when interactive)
  -P, --precision=#                 Number of decimals to use (0-8, default=2)
  -f, --format=ARG                  Output format (see below for valid formats)
      --progress-update-interval=#  Progress update interval (100-1000 milliseconds)
  -u, --unit[=ARG]                  Output unit for displaying speeds (Note: this is only applicable
                                    for ‘human-readable’ output format and the default unit is Mbps)
  -a                                Shortcut for [-u auto-decimal-bits]
  -A                                Shortcut for [-u auto-decimal-bytes]
  -b                                Shortcut for [-u auto-binary-bits]
  -B                                Shortcut for [-u auto-binary-bytes]
      --selection-details           Show server selection details
      --ca-certificate=ARG          CA Certificate bundle path
  -v                                Logging verbosity. Specify multiple times for higher verbosity
      --output-header               Show output header for CSV and TSV formats

3. I only allow secure outbound ports over my firewall.

You should allow/disallow secure/insecure PROTOCOLS, not PORTS: I can have https/tls on port 8080 as I can have TELNET on port 443. So if you allow 443 because you think a port is SECURE, I can let an insecure protocol traverse your firewall using your very secure 443 port.