Opening port in Firewall with Script instead of ServerAdmin?

Hi,
I tried to google this but didn't find good leads. What is the way to open ports in the OS X Server 10.5 Software Firewall by using a shellscript instead of the GUI ServerAdmin tool?
thanks a lot
simon

At the most basic level:
#!/bin/bash
HOST_IP = "123.123.123.123"
/sbin/ipfw -f add 30000 allow tcp from $HOST_IP to any dst-port 20-21
This would add a single rule, assigned to rule number 30000. It opens ports 20 and 21 for the specified IP. After installing this rule via script there are various things that will cause your firewall to be flushed and the rule will be lost. For example, just poking around in ServerAdmin can cause an unintentional flush and reloading of the firewall rules - you'll need a way to run your script again when it happens.
Check the man page and google for info on ipfw.
David
Message was edited by: DavidWil

Similar Messages

Opening port in Firewall to allow media sharing with PS3

What I'm trying to do: Stream media from my G5 to my PlayStation3 using Nullriver's Media Link.
It would not work and I've determined that it's the Firewall that's the problem. I've read elsewhere that the firewall in my router (Airport extreme) will suffice and that the G5's firewall is redundant. Even if that is true I'm still puzzled as to why I couldn't open a hole in the firewall.
I turned on Firewall Logging under advanced in the sharing preference panel, then told the PS3 to search for media servers.
Looking at the ipfw log in Console tells me "...ipfw: 12190 Deny TCP 10.0.1.5..."
So 12190 must be the port that needs to be open for things to work, right?
Here's where I must be goofing up... I go to system preferences>>Sharing>>Firewall.
Then click "New." From the Port Name pop-up, I select Other and then name the hole I intend to open.
Then in the field "TCP Port Number(s)" I enter 12190.
My new item now appears in the list on the firewall pane with a check next to it and when the mouse hovers over the item the tag that pops us tells me that all network traffic on port 12190 is being let through.
Meanwhile in the background, Console reports every minute that the PS3 is being denied access at that port!
I tried restarting the system.
It would be nice to know if it is indeed true that the firewall in OSX is redundant.
But more puzzling is why I can't get this port to open.
Thanks!

Still no luck.
Tried deleting that pref file. Reboot. Created new port opening as before. Still shows that same symptoms.
Tried WaterRoof. When I call up the static rules, it shows the port in question.
"allow tcp from any to any dst-port 12190"
I selected it in the list, clicked the button to edit it, changed nothing, then clicked apply. (I did this in case maybe Waterroof needed to "nudge" things to get them to work right. After this, I was unable to change any settings on the Firewall using System Preferences.
Maybe I'm not using WaterRoof right.
Strange that when I used Terminal as you suggested, it shows a firewall deny at 12190, but WaterRoof says the rule is to allow.
Could there be something wonky going on with the Airport Extreme?
To my non-network savvy brain that doesn't make sense but I bring it up since it's the only other device involved.
If I turn off the firewall on my G5 using System Preferences then everything works fine. Would the Airport "know" what the firewall on my computer was doing?
It's my understanding that the Airport Extreme's firewall protects the network from outside traffic, not that it would protect devices on the network from each other.
I was going to try opening a port on the Airport, but the fields in the Airport Utility are more complicated than those in System Preferences. Figured I should wait before I did anything stupid.
The next thing I'll try is running MediaLink on my wife's Intel iMac. She's running 10.4.11, too, but if I can open a port on her machine, that will narrow things down. Will report back tomorrow.
Thanks.

Closing open ports - using firewall

Have everything set at the most strict settings at my mac book pro, however, came across this link and they suggested several ports where still open. Can or should they be closed? How?
http://www.whatsmyip.org/ports/security/

The OS X firewall that Apple provides is very basic. If you want the very best Unix IPFW firewall to block most all of ports then use the very powerful IPFW GUI application NoobProof. This application use the built-in IPFW Unix firewall in OS X that is stronger than anything you can buy.

How to get mail to open a PPS attachment with Keynote instead of Preview in OS 10.8.5

How do I get Keynote to open a PPS attachment in Mail using OS 10.8.5
It now opens automatically with Preview and I want to change this to Keynote

One more thing. I know you can do the "get info thing" and then change the "open with" however this only works when I drag the attachment to the desktop NOT in Mail.

[SOLVED] Switch x displays with script instead of ctrl-alt fx

Hi, I am looking for a way to switch x displays on a computer without using the keyboard. Is this possible with a bash script of some sort?
EDIT: I found chvt but that only works from a tty, running sh chvt X doesn't work from a terminal emulator.
EDIT2: SOLVED: read this http://superuser.com/questions/69807/wh … ot-under-x
Last edited by RiceKills (2010-10-30 18:27:56)

chvt command maybe what you need.

AGPM 4.0 SP2 Editors cannot open "Windows Firewall with Advanced Security" area of a GPO

When attempting to Edit a checked-out GPO in AGPM, & navigating to "Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP://CN...." Editors
get:
"There was an error opening the Windows Firewall with Advanced Security snap-in
An error occurred while trying to open the policy.
Error: The system cannot find the path specified
Code 0x3"
This happens with GPOs that existed prior to AGPM install where the GPO was "controlled", and with new Controlled GPOs created within AGPM. A workaround is to grant the user Full Control within AGPM (and have them re-launch Group Policy Management
MMC via Shift right-click "Run as different user"), but this circumvents the Change Control we are attempting to use AGPM for. Any ideas of how to fix this, or how to file a bug report?
Also, changes made to Incoming Firewall rules do not show up in the AGPM Settings or Differences reports. I'd imagine this is related to the known issue described on the Release Notes page here:
http://technet.microsoft.com/en-us/library/dn458958.aspx

Hi Fabian - Thanks for the response. I checked & the AGPM Server is on a subnet that was not mapping to any AD Site. Based on its subnet/location, it actually should be in the same Site as the PDCe. I added a new Subnet definition to
AD & waited until "nltest /dsgetsite" was reporting the correct Site on the AGPM Server. Now, with just Editor role, I can access the Advanced Firewall area of a checked out GPO from my AGPM Client, which is correctly in a different AD Site.
I think this might have solved it.
Should this requirement be added to AGPM documentation? "AGPM Server must be installed on a server that is in the same AD Site as the DC holding the PDCe role."
Thanks for the tip!

How to open port 80 443, 1863

Hello can anyone help.
I have a message that I need to open these ports to play online backgammon.
I have windows 7 home premium how do I open these ports?

Hi,
Follow this:
Open a port in Windows Firewall
http://windows.microsoft.com/en-in/windows/open-port-windows-firewall#1TC=windows-7
Karen Hu
TechNet Community Support

Standard (application-based) firewall with one additional port open?

Lion and Snow Leopard both have application based firewalls. I want to allow access to a Minecraft server on port 25565 but I don't want to allow all of Java. How can I open one port in addition to leaving the standard firewall in place?

Hi
The Zone based firewall uses "inspect" statements, that's just what it does.
A simple zone-based firewall that will inspect all traffic going from the local network to the internet and protecting the outside interface of the router, but allowing anyconnect connections would look something like this:
ip access-list standard INSIDE-NETWORK_ACL
permit 192.168.1.0 255.255.255.0
class-map type inspect INSIDE-NETWORK_CMAP
match access-group name INSIDE-NETWORK_ACL
class-map type inspect HTTPS_CMAP
match protocol https
policy-map type inspect INSIDE-TO-OUTSIDE_PMAP
class type inspect INSIDE-NETWORK_CMAP
inspect
policy-map type inspect OUTSIDE-TO-SELF
class type inspect HTTPS_CMAP
pass
zone-pair security INSIDE-TO-OUTSIDE_ZP source INSIDE destination OUTISDE
service-policy type inspect INSIDE-TO-OUTSIDE_PMAP
zone-pair security OUTSIDE-TO-SELF_ZP source OUTSIDE destination self
service-policy type inspect OUTSIDE-TO-SELF
I haven't personally configured Zone Based Firewall with anyconnect. So if this doesn't work you can look at this link: https://supportforums.cisco.com/document/46481/anyconnect-ios-zone-based-firewall-zbfw

Firewall in 10.5, how to open ports and how to manage?

I am pulling my hair out with the new firewall in 10.5. In 10.4 I could just set ports as I liked in the control panel, in 10.5 there is no such thing.
I need to for example open port 49999 to allow PageSender to function in my network.
I need to open port 5901 to work with JollyFast VNC, as port 5900 is used by Apple Remote Desktop and the conflict if they both use the same port.
Some of these ports I need permanent open like 59999 and others for one session and than close again, like 5901. Again in 10.4 I made the rule in the pref pane, ticked the box and Bob was your uncle. Now?
I would like to be able to see what ports are open and active on the machine. I have no idea as to where I could see this.
And at the same time I would like to keep the firewall as closed as possible as I am often on line in hotels etc.
So I need help, is there a manual somewhere someone is aware of? Or do you have any answers?

The new Application Firewall does not work in the same way as IPFW (the main firewall in 10.4).
Instead of managing ports, it simply controls the access of applications to any port. Thus, if you want PageSender to receive connections, you simply need to switch the firewall to "Set access for specific services and applications", and then add PageSender to the list, with "Allow incoming connections". When you do this, PageSender will be able to receive connections on any port that it needs to.
If you don't like this method of controlling connections, you can still use IPFW. Apple has removed the GUI, but you can download a GUI application like [NoobProof|http://www.hanynet.com/noobproof> or [WaterRoof|http://www.hanynet.com/waterroof/index.html], and you can then set access for specific ports.
There are no problems with using both IPFW and Application Firewall.
Cheers,
Rodney

RDS and Gateway issues: Cannot get remoteapps to run without opening port 3389 on firewall

I am testing the setup of a small RDweb server to host QuickBooks for some remote sales users (4 users). For the most part, I have everything installed on one virtual server (using 2012r2 "Quick Start" session host deployment with the additional
Licensing and Gateway server roles added to the same server).
Everything works excellent with one exception. External clients cannot launch published apps without having port 3389 open on the firewall, even with the gateway role installed and the 'Deployment Properties' set to use the gateway. They can properly connect
to the RDweb site and view the published apps. The only way it works is open the firewall port (at which time I can disable the gateway or leave it configured and it works either way). Internally, everything works accordingly. I have followed the steps outlined
on many sites and have combed though the forum here to no avail.
Error received (summarized but is a well documented error):
remote desktop can't connect to the remote computer: 1- Your user account is not listed (it actually is) or 2- You might have specified the remote computer in NetBios format . . etc.
This is an existing SBS 2011 environment with additional virtual servers setup to host QuickBooks as outlined below:
Current setup:
Used Quick Start to install Remote Desktop Services in hosted sessions mode
Installed the additional roles for Licensing and Gateway server on same server
Configured wild card public certificates on all four services (Connection Broker(2), Web Access and Gateway)
Configured internal DNS to properly lookup our external FQDN of this server (ex. quickbooks.contoso.com points to quickbooks.contoso.local
One thing I noticed (just now) when I launch a published app and the firewall has port 3389 closed, a dialog box pops up directly after launching the app that warns about running a RemoteApp program and mentions the Remote Computer and the Gateway Server
as both the same (which it is); however, I would have assumed one would have listed the internal server's name while, instead, both are listed as the external FQDN. Either way, internal DNS should still allow it to properly route . . no? I don't know . . I'm
sure I am just missing something in a routing configurations somewhere. The gateway service is not properly looking up the RDweb service and then seeming not routing the encapsulated RDP session through HTTPS. . .. is my guess . .
I was reading about the "set published name" commandlet; however, I am not experiencing a certificate name mismatch; however, the certificate name does show up as *.contoso.com versus the actual name. I may just be grasping as straws now . . :)

Ok, while I was in the server and looking over the BPA scans: "The Remote Desktop Gateway (RD Gateway) server Secure Sockets Layer (SSL) certificate may not have a valid certificate subject name." This may be due to it showing up as *.companyname.com
versus quickbooks.companyname.com. Anyhow. .. on to the list of actions above:
Changed RD RAP from "Select Active Directory" group to "Allow any network resource" and tested with port 3389 closed on firewall:
Worked. Initially it did not as I had used a custom shortcut created from earlier; however, after logging into the RDweb site again, the application loaded fine now (after the RD RAP change)
No error message appeared; however, I did notice that for a split second, the word Error did appear in the browser's tab title, but only very shortly. The app launch does take a bit longer too now (about 10-15 seconds, up from about 4 seconds with the port
open). This, I could care less about so long as we are properly forwarding the traffic through the gateway.
As for log entries, I had spend quite a bit of time in there and only had minor issues with loading user profile setting taking too long and policy settings preventing the redirection of USB devices. Looking again, no issues still. Just a bunch of informational
entries where I would connect before (and disconnect) but only with the port on the firewall open; otherwise, there was not an entry corrolating to when I would receive an error before. Now though, I am connecting after the RD RAP change and logs are showing
connections even with the port closed. These are in "operational", the "admin" log only shows the update to the RD RAP configuration.
Yes, the LAN's DNS server does relay the lookup information for my public FQDN as the local LAN address. No need for a local host record.
I have now added a new rule in our firewall to allow and forward UDP port 3391 traffic to the internal server hosting remote services
Thank you very much for your assistance on this matter. The RD RAP rule was default built during the creation of this services. Why is the resource not cross-referencing AD security groups? I could have sworn I created a group for that . . .

Open port issues with Direct Print functionality

Hi, I have been fighting with HP call support about the Photosmart 7525 printer.
Originally I setup and had performed all the functions to enable both web support and WIFI.
Within an hour the printer would not respond to wireless communication, though it had its wireless indecator showing it was connected.
I was told by HP support that the issue will be resolved in March, as there will be a firmware update to fix the issue.
Now that I had the printer install the new firmware I still get the issue.
Though I found through some sniffing, that there are a number of ports enabled and open that are over and beyond print requirements.
Funny thing I can send my printer into instant lockup with all lights flashing with a simple UDP ping sniff. I would think I can do this with other new HP printers using Eprint functions. I will find HP web based printers that are open for public printing and test my theory that HP Eprinters are open to hacking and denyal of service attempts. My Hp print app on andriod list three in my area, and one is at my local Walmart. This would be cool to find this, as I am usually not the first to point such matters out.
I assume some are for Apple devices to print.
Here is my sniffing report:
Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-21 07:57 Central Daylight TimeNSE: Loaded 110 scripts for scanning.NSE: Script Pre-scanning.Initiating ARP Ping Scan at 07:57Scanning 192.168.223.1 [1 port]Completed ARP Ping Scan at 07:57, 0.23s elapsed (1 total hosts)Initiating Parallel DNS resolution of 1 host. at 07:57Completed Parallel DNS resolution of 1 host. at 07:58, 16.50s elapsedInitiating SYN Stealth Scan at 07:58Scanning 192.168.223.1 [1000 ports]Discovered open port 445/tcp on 192.168.223.1Discovered open port 139/tcp on 192.168.223.1Discovered open port 80/tcp on 192.168.223.1Discovered open port 443/tcp on 192.168.223.1Discovered open port 8080/tcp on 192.168.223.1Discovered open port 9220/tcp on 192.168.223.1Discovered open port 6839/tcp on 192.168.223.1Discovered open port 631/tcp on 192.168.223.1Discovered open port 7435/tcp on 192.168.223.1Discovered open port 8089/tcp on 192.168.223.1Discovered open port 9100/tcp on 192.168.223.1Completed SYN Stealth Scan at 07:58, 1.71s elapsed (1000 total ports)Initiating UDP Scan at 07:58Scanning 192.168.223.1 [1000 ports]Discovered open port 5353/udp on 192.168.223.1Completed UDP Scan at 07:58, 1.82s elapsed (1000 total ports)Initiating Service scan at 07:58Scanning 20 services on 192.168.223.1Discovered open port 161/udp on 192.168.223.1Discovered open|filtered port 161/udp on 192.168.223.1 is actually open
Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-21 07:51 Central Daylight TimeNmap scan report for 192.168.223.1Host is up (0.0025s latency).Not shown: 93 closed portsPORT     STATE SERVICE     VERSION80/tcp   open http        HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)139/tcp open tcpwrapped443/tcp open ssl/http    HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)445/tcp open netbios-ssn631/tcp open http        HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)8080/tcp open http        HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)9100/tcp open jetdirect?MAC Address: A03:C1:BD:C8:34 (Unknown)Device type: printer|general purposeRunning: HP embedded, Wind River VxWorksOS CPE: cpe:/h:hp:laserjet_cm1415fnw cpe:/h:hp:laserjet_cp1525nw cpe:/h:hp:laserjet_1536dnf cpe:/o:windriver:vxworksOS details: HP LaserJet CM1415fnw, CP1525nw, or 1536dnf printer, VxWorksNetwork Distance: 1 hopService Info: Device: printer; CPE: cpe:/h:hphotosmart_7520OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 34.11 seconds

OK now I am able to run a full scan on TCP ports without causing a lock up of the printer.
I found that having the printer connect to a router that has been setup to use channel 5, 6 or 7 will cause port scanning issues with the printer.
It is obvious that there are 18 ports that are seen as open, whether they are used or not. Two of which are active but have no service connected to them. Some are just dead like port 25, but over half are active enough to recieve data and lock network connectivity within the printer.
As the firmware states some other laser jets may be affected depending on how the configuration can be set.
I moved my routers channel to channel 1 as it is the only other option I have in a highly congested location. It is not as good as channel 6, but the printer seems to have channel 6 locked in for direct printing.
Here is the latest full scan with UDP enabled, it is the furthest and most complete scan I am able to complete, with UDP ports enabled. The TCP port scan has a bit more and I have placed a simple list below the information given here:
Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-21 13:27 Central Daylight Time
NSE: Loaded 110 scripts for scanning.
NSE: Script Pre-scanning.
Initiating ARP Ping Scan at 13:27
Scanning 192.168.1.211 [1 port]
Completed ARP Ping Scan at 13:27, 0.44s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 13:27
Completed Parallel DNS resolution of 1 host. at 13:27, 0.03s elapsed
Initiating SYN Stealth Scan at 13:27
Scanning 192.168.1.211 [1000 ports]
Discovered open port 443/tcp on 192.168.1.211
Discovered open port 80/tcp on 192.168.1.211
Discovered open port 139/tcp on 192.168.1.211
Discovered open port 8080/tcp on 192.168.1.211
Discovered open port 445/tcp on 192.168.1.211
Discovered open port 631/tcp on 192.168.1.211
Discovered open port 9100/tcp on 192.168.1.211
Discovered open port 7435/tcp on 192.168.1.211
Discovered open port 9220/tcp on 192.168.1.211
Discovered open port 6839/tcp on 192.168.1.211
Completed SYN Stealth Scan at 13:27, 5.25s elapsed (1000 total ports)
Initiating UDP Scan at 13:27
Scanning 192.168.1.211 [1000 ports]
Discovered open port 137/udp on 192.168.1.211
Completed UDP Scan at 13:27, 4.46s elapsed (1000 total ports)
Initiating Service scan at 13:27
Scanning 16 services on 192.168.1.211
Discovered open port 161/udp on 192.168.1.211
Discovered open|filtered port 161/udp on 192.168.1.211 is actually open
Completed Service scan at 13:29, 82.51s elapsed (17 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.211
NSE: Script scanning 192.168.1.211.
Initiating NSE at 13:29
Completed NSE at 13:30, 82.29s elapsed
Nmap scan report for 192.168.1.211
Host is up (0.023s latency).
Not shown: 1983 closed ports
PORT     STATE         SERVICE      VERSION
80/tcp   open          http         HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)
|_http-favicon: Unknown favicon MD5: 76C6E492CB8CC73A2A50D62176F205C9
| http-methods: GET POST PUT DELETE
| Potentially risky methods: PUT DELETE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
|_http-title: Site doesn't have a title (text/html).
139/tcp open          tcpwrapped
443/tcp open          ssl/http     HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)
|_http-favicon: Unknown favicon MD5: 76C6E492CB8CC73A2A50D62176F205C9
| http-methods: GET POST PUT DELETE
| Potentially risky methods: PUT DELETE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=HPPS7525/organizationName=HP/stateOrProvinceName=Washington/countryName=US
| Issuer: commonName=HPPS7525/organizationName=HP/stateOrProvinceName=Washington/countryName=US
| Public Key type: rsa
| Public Key bits: 1024
| Not valid before: 2014-02-25T10:12:24+00:00
| Not valid after: 2034-02-20T10:12:24+00:00
| MD5:   9144 ca3b 557e 09cc aba0 8387 2732 2375
|_SHA-1: a6b2 95c0 b72a 7201 578c 32de 662a e6fe b082 48ca
|_ssl-date: 2014-03-21T13:30:09+00:00; -4h59m12s from local time.
445/tcp open          netbios-ssn
631/tcp open          http         HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)
| http-methods: GET POST PUT DELETE
| Potentially risky methods: PUT DELETE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
6839/tcp open          tcpwrapped
7435/tcp open          tcpwrapped
8080/tcp open          http         HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)
|_http-favicon: Unknown favicon MD5: 76C6E492CB8CC73A2A50D62176F205C9
| http-methods: GET POST PUT DELETE
| Potentially risky methods: PUT DELETE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
|_http-title: Site doesn't have a title (text/html).
9100/tcp open          jetdirect?
9220/tcp open          hp-gsg       HP Generic Scan Gateway 1.0
137/udp open          netbios-ns   Samba nmbd (workgroup: HPPS7525)
138/udp open|filtered netbios-dgm
161/udp open          snmp         SNMPv1 server (public)
| snmp-hh3c-logins:
|_ baseoid: 1.3.6.1.4.1.25506.2.12.1.1.1
| snmp-interfaces:
|   Wifi0
|     IP address: 192.168.1.211 Netmask: 255.255.255.0
|     MAC address: a0:d3:c1:bd:c8:32 (Unknown)
|     Type: ethernetCsmacd Speed: 10 Mbps
|     Status: up
|_    Traffic stats: 6.16 Mb sent, 3.43 Mb received
| snmp-netstat:
|   TCP 0.0.0.0:7435         0.0.0.0:0
|   TCP 192.168.1.211:56076 15.201.145.52:5222
|   UDP 0.0.0.0:3702         *:*
|   UDP 127.0.0.1:666        *:*
|_ UDP 192.168.223.1:67     *:*
| snmp-sysdescr: HP ETHERNET MULTI-ENVIRONMENT
|_ System uptime: 0 days, 3:34:23.28 (1286328 timeticks)
| snmp-win32-shares:
|_ baseoid: 1.3.6.1.4.1.77.1.2.27
1022/udp open|filtered exp2
1023/udp open|filtered unknown
3702/udp open|filtered ws-discovery
5355/udp open|filtered llmnr
MAC Address: A03:C1:BD:C8:32 (Unknown)
Device type: general purpose
Running: Wind River VxWorks
OS CPE: cpe:/o:windriver:vxworks
OS details: VxWorks
Uptime guess: 0.150 days (since Fri Mar 21 09:55:04 2014)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: Busy server or unknown class
Service Info: Hosts: HPA0D3C1BDC832, HPPS7525; Device: printer; CPE: cpe:/h:hphotosmart_7520
Host script results:
| nbstat:
|   NetBIOS name: HPA0D3C1BDC832, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
|   Names
|     HPA0D3C1BDC832<00>   Flags: <unique><active><permanent>
|     MSHOME<00>           Flags: <group><active><permanent>
|     HPA0D3C1BDC832<20>   Flags: <unique><active><permanent>
|     HPPS7525<00>         Flags: <unique><active><permanent>
|_    HPPS7525<20>         Flags: <unique><active><permanent>
| smb-security-mode:
|   Account that was used for smb scripts: guest
|   User-level authentication
|   SMB Security: Challenge/response passwords supported
|_ Message signing disabled (dangerous, but default)
TRACEROUTE
HOP RTT      ADDRESS
1   23.26 ms 192.168.1.211
NSE: Script Post-scanning.
Read data files from: F:\Progs\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 180.90 seconds
           Raw packets sent: 2030 (74.829KB) | Rcvd: 2921 (149.377KB)
+++++++++++++++++++++++++++++++++++++++++++++++++++++===
Full TCP port scan without UDP scanning of all ports, showing up as open... * designates open and active.
192.168.223.1Discovered open port 25/tcp on
*192.168.223.1Discovered open port 80/tcp on
*192.168.223.1Discovered open port 110/tcp on
*192.168.223.1Discovered open port 119/tcp on
*192.168.223.1Discovered open port 139/tcp on
192.168.223.1Discovered open port 143/tcp on
*192.168.223.1Discovered open port 443/tcp on
*192.168.223.1Discovered open port 445/tcp on
192.168.223.1Discovered open port 465/tcp on
192.168.223.1Discovered open port 563/tcp on
192.168.223.1Discovered open port 587/tcp on
*192.168.223.1Discovered open port 631/tcp on
192.168.223.1Discovered open port 993/tcp on
192.168.223.1Discovered open port 995/tcp on
*192.168.223.1Discovered open port 7435/tcp on
*192.168.223.1Discovered open port 6839/tcp on
*192.168.223.1Discovered open port 8080/tcp on
192.168.223.1Discovered open port 8089/tcp on
*192.168.223.1Discovered open port 9100/tcp on
*192.168.223.1Discovered open port 9220/tcp on

Ports and IPs to be open/permitted in firewall to download and work in creative cloud

What is the complete list of ports and IP addresses to be open/permited in our enterprise firewall in order to let internal PCs download and work with creative cloud applications?

Our firewall only supports IP configuration (not URL). Do you have IP list?
From: Rajshree [email protected]
Sent: miércoles, 06 de noviembre de 2013 17:23
To: Simon, Mariano
Subject: Ports and IPs to be open/permitted in firewall to download and work in creative cloud
Re: Ports and IPs to be open/permitted in firewall to download and work in creative cloud
created by Rajshree <http://forums.adobe.com/people/Rajshree> in Adobe Creative Cloud - View the full discussion <http://forums.adobe.com/message/5819892#5819892

RMI firewall issue - opening port 1099 is not enough

Hello,
We have a distributed java desktop app that uses RMI with callbacks to communicate amongst the clients. It all works really well at our dev site and at 2 trial sites.
We are about to deploy out to more customer sites - so I have been doing more testing with firewalls etc and discovered some issues. Our customers are small businesses and typically have between 1 and 10 desktop clients that connect to the server via RMI. These customers are "very NOT technical", so we need to give them set-and-forget firewalls etc.
This is all on a LAN, with RMI using port 1099. On the firewalls (of the various PCs) we open ports 1099 (RMI) and 5432 (for the Postgres DB).
Also, I was using "CurrPorts" and "SmartSniff" to monitor the traffic at each PC - so I had a reasonable view of proceedings.
Basically, opening port 1099 on the server is necessary, but it is NOT ENOUGH. The RMI moves off to ports other than 1099, and the server firewall does not allow the connection.
Procedure ...
(1) start the "server" app - which starts the RMI registry - the "localhost" desktop app also starts and it works well to both the database and the RMI.
(2) start another client - it connects to the DB Server, but NOT the RMI server.
(3) open the server firewall to all traffic for a few seconds - then the client connects successfully.
From CurrPort logging I could watch the RMI comms progress over those first few minutes ...
Initially the comms do include port 1099 on the initial call to the server, but there after there are always 2 or 3 "channels" open, but not to 1099.
I notice that the Postgres DB keeps using port 5432 for all of its active channels - so it does not have the same firewall issue.
After we have opened the firewall for a few seconds - to enable the link - then we can turn the client on and off and the client re-connects without issue - so it would seem to be only an issue with the initial connection.
I am sure that this is all completely standard and correct RMI behavior.
QUESTIONS:
1. Can RMI be "forced" to always use port 1099 for connections, and not move to other ports? (like the database uses 5432)
2. Are there any suggestions for getting around this seemingly standard RMI behaviour?
Other comments ...
The firewall lets me open individual ports (say 1099) - BUT I can not justify opening ALL ports.
The firewall lets me open all ports to an application, say "C:\Program Files\Java\jre6\bin\java.exe", but that app will occasionally change at a customer's site as they will update their java version and suddenly our app will stop working.
Any guidance is appreciated.
Many Thanks,
-Damian

1. Can RMI be "forced" to always use port 1099 for connectionsYes. Export all your servers on the same port. See UnicastRemoteObject constructor that takes an int, or UnicastRemoteObject.exportObject(int). If the RMI Registry is a separate process you can't re-use 1099 for this purpose, but see below.
2. Are there any suggestions for getting around this seemingly standard RMI behaviour?Yes. Start the RMI Registry in the same JVM as the code, then you only need to use 1099 for everything.
If you are using server socket factories, make sure they have an equals() method, or use the same instance for all remote objects.

How to open a port on firewall

I have a RV110W firewall installed. Now behind this firewall there is a server running. I need to access this server from outside of the store through a specific TCP port.
Physical connection from outside to the server is like this.
Outside -> Router -> Firewall -> Server
Router IP: 192.168.1.1
Firewall WAN IP: 192.168.1.5
Firewall LAN IP: 192.168.2.1
Firewall Gateway IP: 192.1681.1
Server IP: 192.168.2.10
The firewall is in gateway mode.
Now I forwarded a TCP port on router to firewall (192.168.1.5) and on the firewall i forwarded the same port to server (192.168.2.10).
On the server system, i opened the port on windows firewall for inbound.
This there anything I am missing?

Hello
your steps seems to be fine at first look, but somewhere in that chain there is probably something broken.
what kind of service is on that server port?
are you able to open connection from outside with telnet to Router WAN IP and port? example test from outside/internet:
telnet X.X.X.X YYYY
where X.X.X.X is WAN IP of Router and YYYY is port number.
You can confirm that port forwarding is working on both devices:
you can try to connect with computer between Router and Firewall and try that port on firewall.
if previous test works, then for testing purposes move server to subnet between Router and Firewall and perform connectivity test from internet.

Opening port 51325 on firewall

Hello,
In order to get a fast response when the print properties are asked in Office, port 51325 has to be opened on the firewall. After some research on the web I still can't find any reason why...
Anyone knows what this port is used for? Are there any security issues?
Thanks in advance!

Hello,
In order to get a fast response when the print properties are asked in Office, port 51325 has to be opened on the firewall. After some research on the web I still can't find any reason why...
Anyone knows what this port is used for? Are there any security issues?
Thanks in advance!
Can you provide information, links, etc., where you got this information that Office requires this specific port number? Also, is the port# you're referring to a TCP or UDP port?
FYI, TCP & UDP 51325 is part of the dynamic port ranges known as the Service Response Ports, or also known as the Ephemeral Ports. They are ports that are randomly selected (Windows Vista, Windows 2008 and newer operating systems) between
TCP & UDP 49152 - 65535. In Windows 2000, 2003 and XP, they were 1024-5000. Windows NT used the whole range.
The initial port may be an attempt for Office or any other app, that needs access to something else, such as a mapped drive, or sending something to a printer. The initial port may more than likely be an RPC call on TCP 135, but the response from the destination
host will be a randomly generated ephemeral port. And once the session is closed, the port is dissolved.
Here are more specifics on ports in an AD environment:
Active Directory Firewall Ports - Let's Try To Make This Simple (RODC, too)
Published by acefekay on Nov 1, 2011 at 4:31 PM
http://msmvps.com/blogs/acefekay/archive/2011/11/01/active-directory-firewall-ports-let-s-try-to-make-this-simple.aspx
Windows Vista, Windows 7, Windows 2008 and Windows 2008 R2 Service Response Ports (ephemeral ports) have changed.
http://support.microsoft.com/?kbid=929851
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

Opening port in Firewall with Script instead of ServerAdmin?

Similar Messages

Maybe you are looking for