Enable or Disable QUIC

Enabling QUIC

In most cases, it is easy to enable QUIC. Simply open UDP port 443, and QUIC is on by default.

QUIC (or, Quick UDP Internet Connections) is an experimental protocol initially developed by Google in 2012, and announced publicly the following year. QUIC is a good choice for those looking to reduce connection-establishment time and improve congestion control. Since version 5.2, LiteSpeed provides the first production-grade mass-market QUIC implementation available for the public. If you want to serve your web content using the QUIC protocol, LiteSpeed is the solution.

There is no configuration change required in LiteSpeed Web Server. For control panel users, QUIC is turned on by default for Apache HTTPS vhosts. All that is required is to open UDP port 443.

Required:

  • HTTPS with trusted certificate
  • UDP port 443 open at the firewall

Open UDP Port 443 at the Firewall

QUIC runs a stream-multiplexing protocol over Transport Layer Security (TLS) on top of UDP instead of TCP. Be sure you've enabled the port with both TCP and UDP. Most of the time, TCP 443 is already enabled.

You can quickly check to make sure it is listening by running

netstat -lupn | grep 443

udp        0      0 127.0.0.1:443         0.0.0.0:*                               18918/litespeed (ls
udp        0      0 x.x.x.x:443           0.0.0.0:*                               18918/litespeed (ls 
udp        0      0 :::443                :::*                                    18918/litespeed (ls

QUIC itself should auto listen on UDP port 443, but any firewall that is running must be configured so that port 443 is open.

You will need to identify which firewall is running, such as firewalld, iptables, csf, or other external firewalls.

When Using CSF

If CSF is used, you need to enable it at the CSF level. Navigate to ConfigServer Security & Firewall > csf - ConfigServer Firewall > Firewall Configuration > IPv4 Port Settings > and add 443 to the lists in UDP_IN and UDP_OUT.

!CSF Enable QUIC

Also make sure that UDPFLOOD is set to Off 0.

When Using iptables

Enable port 443 with the following command:

iptables -I INPUT -p udp --dport 443 -j ACCEPT
/sbin/service iptables save
/sbin/service iptables restart

Testing Incoming and Outgoing UDP Connections

Although you have enabled UDP on 443 on your server, it may be blocked by the data center at the route, switch, or firewall level. To verify this, you can run the following:

Testing Incoming

To test incoming UDP connections to your server, you can run the following command from somewhere else, such as your local VM, or your other test client machine. Do not run it within the server to be tested:

[root@MYLOCAL /]# nc -v -u your_server_ip 443
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to your_server_ip:443

Testing Outgoing

To test outgoing UDP connections from your server, you can run the following within the testing server:

nc -v -u www.google.com 443 
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 74.125.24.104:443.

Verifying QUIC is Enabled

  • Visit HTTP3CHECK and enter your URL. If QUIC is supported, the service will return a detailed list of supported versions.
  • Look for these headers: alt-svc:quic=":443"; v="35,37", or http/2+quic/37
  • Check quic connections: chrome://net-internals/#quic
  • Install the HTTP/2 and SPDY indicator Chrome extension, and you will see a lightning bolt in the Chrome toolbar. Blue indicates HTTP/2 is enabled. Green indicates HTTP/2 + QUIC. Hover over the lightning bolt to see a more detailed list of protocols in action.

Tip

You should see the QUIC indicator on dynamic pages with a regular refresh. If not, press CTRL + SHIFT + R to request a fresh copy of the page.

!HTTP/2 and SPDY Indicator

Troubleshooting Checklist

If QUIC is not working for you, keep these requirements in mind:

  • Must have QUIC enabled in GUI/conf
  • Must use either Chrome or Opera with QUIC enabled
  • Must not use self-signed certificates only trusted certificates will work
  • Must configure SSL Settings correctly
  • Must have UDP Port 443 open at the firewall
  • QUIC will not work with a proxy front end like CloudFlare
  • QUIC will only applied to HTTPS, not HTTP
  • QUIC can be enabled at the server level, listener level or virtual host level
  • QUIC won't work with LSWS 5.2.8 anymore as Chrome only speaks "quic/43", while LSWS 5.2.8 only supports up to "quic/39"

Three Levels of QUIC Control

QUIC can be enabled or disabled at three different levels: Virtual Host, Listener, and Server. It's important to understand how these settings affect each other. If QUIC is not explicitly turned off at any level, then priority for enabling QUIC is given at the most specific level: Virtual Host, then Listener, then Server. If QUIC is explicity turned off at any level, then none of the more specific levels may turn it on. In other words, if QUIC is turned off at the Server level, then it cannot be turned on at the Listener level or at the Virtual Host level.

Put another way:

For a particular Virtual Host, QUIC will be ON if:

  • Virtual Host Level = ON or is not set AND
  • Listener Level = ON or is not set AND
  • Server Level = ON or is not set.

For a particular Virtual Host, QUIC will be OFF if:

  • Virtual Host Level = OFF OR
  • Listener Level = OFF OR
  • Server Level = OFF.

Here is an example setup:\

!QUIC settings

Disabling QUIC

Server Level

For EA4: Add following lines to /etc/apache2/conf.d/includes/pre_main_global.conf

<IfModule LiteSpeed>
  QuicEnable off
</IfModule>

Virtual Host Level

For EA4: Create a quic_vhosts.conf file in the /etc/apache2/conf.d/userdata/str/2_4/user/domain/ then add following lines.

<IfModule LiteSpeed>
  QuicEnable off
</IfModule>

For an SSL website, create quic_vhosts.conf in /etc/apache2/conf.d/userdata/ssl/2_4/<user>/<domain>.

If you want to disable QUIC for an account you can create quic_vhosts.conf in /etc/apache2/conf.d/userdata/ssl/2_4/<user>.

After these changes are made, rebuild Apache conf with the following command:

/usr/local/cpanel/scripts/rebuildhttpdconf

Finally, restart LiteSpeed Web Server.

Troubleshooting

CloudFlare doesn't support QUIC yet

Please keep in mind that CloudFlare doesn't currently support QUIC at the time of this writing. If you are behind CloudFlare, please disable it before testing/using QUIC.

Possibly Google Chrome has not enabled QUIC by default

At some point we noticed that Google Chrome decided to temporarily disable QUIC by default. Some users explicitly have to enable QUIC under chrome://flags. This may not be the case for you, but it's a good idea to check whether QUIC is enabled in Chrome.

Possibly bad cached SSL certificates

Sometimes, especially when the site in question has encountered an SSL/TLS error before, Chrome will save the certificate in cache and cause QUIC to be unable to establish a connection. In this case, it can simply be fixed by clearing the browser cache.

UDP rate limiting option in CSF should be disabled

If CSF is used, the UDP rate-limiting option is normally disabled by default. You should see UDPFLOOD = "0". However, if you have enabled it somehow, please disable it before running any QUIC checker, such as http3check.net.

# Outgoing UDP Flood Protection. This option limits outbound UDP packet floods.
# These typically originate from exploit scripts uploaded through vulnerable
# web scripts. Care should be taken on servers that use services that utilise
# high levels of UDP outbound traffic, such as SNMP, so you may need to alter
# the UDPFLOOD_LIMIT and UDPFLOOD_BURST options to suit your environment
#
# We recommend enabling User ID Tracking (UID_INTERVAL) with this feature
UDPFLOOD = "0"
UDPFLOOD_LIMIT = "100/s"
UDPFLOOD_BURST = "500"
# This is a list of usernames that should not be rate limited, such as "named"
# to prevent bind traffic from being limited.
#
# Note: root (UID:0) is always allowed
UDPFLOOD_ALLOWUSER = "named"

LF_SPI needs to be turned off when CSF is used

LF_SPI in CSF should be turned off (set LF_SPI = 0).

According to CFS, LF_SPI option configures CSF iptables as a Stateful Packet Inspection (SPI) firewall as the default (which means LF_SPI = 1). If the server has a broken stateful connection tracking kernel then this setting can be set to 0 to configure CSF iptables to be a Static firewall, though some funtionality and security will be inevitably lost.

!CSF SPI Settings


Last update: April 17, 2020