How do WebSockets interact with firewalls and proxies?

WebSockets use the standard HTTP/HTTPS ports (80/443) for the initial handshake and upgrade, which generally passes through most firewalls. However, several proxy-related issues exist: (1) HTTP proxies — many corporate transparent proxies don't understand the Upgrade mechanism and close the connection after the handshake. Solution: use wss:// (encrypted traffic bypasses proxy inspection in most cases); (2) Long-lived connections — proxies and load balancers often have idle connection timeouts (60s–5min). Solution: implement WebSocket ping/pong heartbeat to keep connections alive; (3) NGINX configuration — requires explicit proxy_http_version 1.1, proxy_set_header Upgrade $http_upgrade, and proxy_set_header Connection upgrade settings; (4) AWS ALB — natively supports WebSocket without special configuration when using HTTP/HTTPS listeners; (5) Cloudflare — supports WebSocket on all plans (previously paid only).