Proxy and filter on same port

Question

Hi all,
On our BorderManager 3.8 server we've got a HTTP-proxy listening on port 8080. Now, a new external web-app requires a direct connection on port 8080 also. I thought about defining a statefull filter allowing port 8080 from internal to external for that specific site but I'm not sure if this would cause conflicts or security issues in any way. I don't think so, but because it's better to be safe than sorry....I thought I'd ask. ;-)
Arnold...

Answer 1

In article <_7z%j.371$[email protected]>, Arnold Jesse
wrote:
> On our BorderManager 3.8 server we've got a HTTP-proxy listening on
> port 8080. Now, a new external web-app requires a direct connection
> on port 8080 also. I thought about defining a statefull filter
> allowing port 8080 from internal to external for that specific site
> but I'm not sure if this would cause conflicts or security issues in
> any way. I don't think so, but because it's better to be safe than
> sorry....I thought I'd ask. ;-)
>
First, realize that the proxy is listening on port 8080 only for
requests coming to the proxy's IP address, so it's not going to
conflict with a request to port 8080 on a remote web site. What
should be happening here is that (on port 8080) you send the proxy a
request to a web site that uses port 8080. The proxy sends a request
to the web site using port 8080 instead of the usual port 80, that's
all.
What could well be a problem here is that the default 3.7-3.9 filter
exceptions do not allow port 8080 out from the public IP address of the
proxy. You will have to modify the default filter exceptions to allow
that traffic, whether you want to connect directly through NAT or
through the proxy. My advice is to connect through the proxy, and
modify the filter exceptions to allow the traffic.
At the least, you could configure a custom filter exception for
stateful port 8080, like the defaults. Look at the defaults in
FILTCFG.NLM to see how they are done, and add a new one.
Personally, I don't like to add custom filter exceptions one-by-one for
every non-standard web server out there. I use a more global approach,
detailed in the advanced chapter of my BMgr filtering book (see url
below).
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***