Do QUIC and HTTP/3 blind firewalls?

They reduce what older firewalls can see, but they do not make traffic invisible. QUIC (RFC 9000, 2021) is the transport under HTTP/3. It runs over UDP port 443 and encrypts almost everything, including much of what TCP left readable, such as packet numbers and acknowledgements. Its first packets carry a TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. 1.3 ClientHello protected only with keys anyone can derive, so a sensor that understands QUIC can still read the server name and handshake parameters. Firewalls and proxies built for TCP often cannot inspect QUIC at all. Common practice in companies that rely on TLS inspection or web filtering is to block UDP port 443, which makes browsers fall back to HTTP/2 over TCP without users noticing. Without such a policy, QUIC simply appears as UDP flows with timing and volume like any other traffic, and flow-based detections such as beaconing and unusual upload volume still apply. Check whether your firewall reports QUIC before assuming it is covered.

← All 40 questions on Encryption and encrypted trafficAll topics