Firewall and Network Considerations for HTTP/3

Network Challenges for HTTP/3 Deployment

HTTP/3's use of QUIC over UDP introduces network infrastructure challenges that did not exist with TCP-based HTTP/1.1 and HTTP/2.

Why UDP Is Problematic

Most internet infrastructure was designed with TCP in mind:

• Firewalls: Many corporate firewalls block all UDP except DNS (port 53)
• NAT devices: UDP NAT mappings expire faster than TCP (30s vs hours)
• ISP throttling: Some ISPs deprioritize or throttle UDP traffic
• DDoS protection: UDP-based DDoS attacks are common, so some DDoS mitigation services block UDP aggressively

Enterprise Networks

Enterprise networks present the biggest challenge:

1. TLS inspection proxies: Many enterprises use MITM proxies to inspect encrypted traffic. These proxies understand TLS-over-TCP but cannot inspect QUIC traffic. This means either:

   • QUIC must be blocked (falling back to HTTP/2)
   • The proxy must be upgraded to support QUIC
   • QUIC is allowed unmonitored

2. Network monitoring: Deep packet inspection (DPI) tools may not recognize QUIC or may misclassify it as suspicious UDP traffic.

3. QoS policies: Quality of Service rules that prioritize TCP web traffic may not apply to QUIC.

Handling QUIC Blocking

The good news: browsers handle QUIC blocking gracefully. If QUIC is blocked or unreachable:

1. The browser attempts a QUIC connection
2. If it fails (timeout, ICMP unreachable), the browser falls back to TCP
3. The browser remembers the failure and avoids QUIC for that domain for a period
4. Periodically, the browser retries QUIC to check if blocking has been lifted

Browser behavior when QUIC is blocked:
First request:  Try QUIC (1s timeout) -> Fall back to TCP/HTTP/2
Next requests:  Use TCP directly (cached knowledge)
After 5 min:    Retry QUIC in background

Recommendations for Deployment

1. Always keep HTTP/2 as fallback — never require HTTP/3
2. Monitor QUIC vs TCP ratios — unusually high fallback rates indicate network issues
3. Set reasonable Alt-Svc max-age — 86400 (1 day) is a good default
4. Test on enterprise networks — if your users are in corporate environments, test behind typical enterprise firewalls
5. Coordinate with network teams — ensure UDP 443 is open and QUIC is not rate-limited