You enable HTTP/3 in Cloudflare panel or compile nginx with QUIC. Benchmarks promise lower latency. Then an enterprise client behind "allow all except UDP" firewall loads nothing — or waits seconds before falling back to HTTP/2, without understanding why.
HTTP/3 is not "faster HTTPS." It is HTTPS over UDP, with same filtering constraints as VPN or online game — often forgotten on brochure sites.
QUIC in brief: TCP is no longer transport
| Protocol | Transport | Usual port | Typical filtering |
|---|---|---|---|
| HTTP/1.1, HTTP/2 | TCP | 443 | Almost always open |
| HTTP/3 (QUIC) | UDP | 443 | Often blocked or rate-limited |
QUIC multiplexes TLS 1.3 and transport. Firewall allowing "HTTPS" on TCP does not automatically open UDP 443.
Announcing HTTP/3 via Alt-Svc without end-to-end UDP path only adds connection attempt that may timeout.
Where UDP gets blocked
Corporate firewall — "UDP forbidden except DNS" policy.
Cloud security groups — TCP 443 rule only, udp/443 forgotten.
Anti-DDoS / scrubbing — some centers filter UDP aggressively.
Shared host — QUIC unsupported or UDP not routed to your instance.
Origin vs CDN — edge may speak h3 with visitor; if origin speaks HTTP/2 only, fine as long as CDN terminates QUIC.
Tests before switch
curl --http3-only -I https://yourdomain.tld
curl -sI https://yourdomain.tld | grep -i alt-svc
nc -u -v your-server.tld 443
Test from corporate VPN, 4G, residential ISP. Document networks where UDP 443 fails. If you terminate TLS at CDN, also verify edge→origin path: HTTP/2-only origin behind public HTTP/3 Cloudflare stays valid as long as visitors never contact origin directly.
nginx example: listen 443 quic reuseport;, http3 on;, Alt-Svc header. Open udp/443 on OS firewall and security group — plus tcp/443.
The summit: HTTP/3 is optional — filtered UDP is not
Decide and move forward without blind spots
Open udp/443 on all firewalls between Internet and origin if QUIC terminates at your server. Test curl --http3-only from at least three network types. Monitor timeouts after Alt-Svc activation. Compare hosts documenting QUIC support via comparator and directory.
Frequently asked questions
Does HTTP/3 require opening a port other than 443?
No — QUIC uses UDP 443. But TCP 443 rule alone is not enough; explicitly add udp/443.
How do you know if your site already offers HTTP/3?
DevTools Protocol column, curl --http3-only, Alt-Svc header — three complementary checks.
Why does HTTP/3 not activate despite configured nginx?
Firewall, security group, anti-DDoS, or ISP filtering UDP — verify full path, not only server config.
Should you disable HTTP/3 if UDP is filtered?
Clients fall back to HTTP/2; partial filtering can still cause timeouts — test before publicly announcing h3.
Before enabling HTTP/3, one question suffices: does UDP 443 pass end to end? Without measured yes, toggle stays premature.