RMI firewall issue - opening port 1099 is not enough

Hello,
We have a distributed java desktop app that uses RMI with callbacks to communicate amongst the clients. It all works really well at our dev site and at 2 trial sites.
We are about to deploy out to more customer sites - so I have been doing more testing with firewalls etc and discovered some issues. Our customers are small businesses and typically have between 1 and 10 desktop clients that connect to the server via RMI. These customers are "very NOT technical", so we need to give them set-and-forget firewalls etc.
This is all on a LAN, with RMI using port 1099. On the firewalls (of the various PCs) we open ports 1099 (RMI) and 5432 (for the Postgres DB).
Also, I was using "CurrPorts" and "SmartSniff" to monitor the traffic at each PC - so I had a reasonable view of proceedings.
Basically, opening port 1099 on the server is necessary, but it is NOT ENOUGH. The RMI moves off to ports other than 1099, and the server firewall does not allow the connection.
Procedure ...
(1) start the "server" app - which starts the RMI registry - the "localhost" desktop app also starts and it works well to both the database and the RMI.
(2) start another client - it connects to the DB Server, but NOT the RMI server.
(3) open the server firewall to all traffic for a few seconds - then the client connects successfully.
From CurrPort logging I could watch the RMI comms progress over those first few minutes ...
Initially the comms do include port 1099 on the initial call to the server, but there after there are always 2 or 3 "channels" open, but not to 1099.
I notice that the Postgres DB keeps using port 5432 for all of its active channels - so it does not have the same firewall issue.
After we have opened the firewall for a few seconds - to enable the link - then we can turn the client on and off and the client re-connects without issue - so it would seem to be only an issue with the initial connection.
I am sure that this is all completely standard and correct RMI behavior.
QUESTIONS:
1. Can RMI be "forced" to always use port 1099 for connections, and not move to other ports? (like the database uses 5432)
2. Are there any suggestions for getting around this seemingly standard RMI behaviour?
Other comments ...
The firewall lets me open individual ports (say 1099) - BUT I can not justify opening ALL ports.
The firewall lets me open all ports to an application, say "C:\Program Files\Java\jre6\bin\java.exe", but that app will occasionally change at a customer's site as they will update their java version and suddenly our app will stop working.
Any guidance is appreciated.
Many Thanks,
-Damian

1. Can RMI be "forced" to always use port 1099 for connectionsYes. Export all your servers on the same port. See UnicastRemoteObject constructor that takes an int, or UnicastRemoteObject.exportObject(int). If the RMI Registry is a separate process you can't re-use 1099 for this purpose, but see below.
2. Are there any suggestions for getting around this seemingly standard RMI behaviour?Yes. Start the RMI Registry in the same JVM as the code, then you only need to use 1099 for everything.
If you are using server socket factories, make sure they have an equals() method, or use the same instance for all remote objects.

Similar Messages

The access to our new chess hall may be blocked by your local firewall. You would need to reconfigure your firewall to open port 15010 for TCP traffic.

How do I do the following so I can get into my chess program??
The access to our new chess hall may be blocked by your
local firewall. You would need to reconfigure your firewall to open port 15010
for TCP traffic.

This is not really Firefox related.
What you need to do here is to read the firewall manual which usually explains how to create a rule for what you want to do.
If you're using the Windows XP firewall, see this Microsoft article: http://windows.microsoft.com/en-US/windows-vista/Firewall-frequently-asked-questions

Could not open the file. Not enough memory

I have always used fireworks cs4 normally, but today, i experienced a bit of trouble. there is one png file that when i click to open it the fireworks loads but then a message pops up (could not open the file. Not enough memory) after a bit of researching, i found out that this error happens when i bring to stage one of the common libraries menu bars. (menu bar 4). Does anyone know how to fix this?
ps: I am able to open this file via file-open-*png. Please i really need help. Is the library corrupted maybe?

Hi,
It opened on mine (1.2Gb). I don't think it's a memory issue. I've used FWCS4 with 512mb RAM, never had such a problem. (of course it was very slow at the start, and i used to leave for a cup of coffee first and then come back when it was ready for work. That's why i upgraded to 1.2G .)
Import this menu bar from the common library, save it again as a png and then open it with fireworks the way you did, to see if the same error occurs.
Has this happened with other files as well?

I see message "Cannot open the file. Not enough memory to open the file"

When I'm trying to open file from adobe.com on my tablet, I see massage " Cannot open the file. Not enough memory to open the file" . I've got 10 gb free memory , so I dont know, why...

Which system are you running (is this information correct in your profile)?
Are there complicating issues to this question such as you transferring libraries between computers?
Have you upgraded iTunes recently?
Troubleshooting iTunes installation on Mac OS X - http://support.apple.com/kb/HT2311 - read section on Opening iTunes for information about running multiple copies of iTunes.

"iTunes application could not be opened. There is not enough memory availab

I just upgraded to the new 7.3 version of iTunes, and now it wont even let me open iTunes. I get an error box that says "iTunes application could not be opened. There is not enough memeory available." However, I have way more than enough memory available, and I've had no problems with any other applications. Quicktime is working just fine as well. I've tried restarting and opening iTunes from every location I could think of. Any ideas on how to fix this? Thanks!

It's a unified GUI program http://gui.interacto.net/ and some people (including me) have had this error message when using it with iTunes 7 Their latest version 1.3.1 seems to overcome this, but if you are not using it ........!
It might be worth reading this thread http://discussions.apple.com/thread.jspa?messageID=3095171&#3095171 as a couple of people on it have tried other things

Open port 916/udp not closeable

A nmap scan from the Internet (WAN) against a Cisco RV120W shows an open port 916/udp. This port remains open even if one writes an explicit access rule for the firewall.
A quick googling shows that this port is probably used to access the firmware of the router from the outside as well as it has been involved in security problems some years ago. See http://osvdb.org/show/osvdb/34520
How can this port be closed?
Michael

Dear Michael,
Thank you for reaching the Small Business Support Community.
I would first suggest you to upgrade to the latest firmware release version 1.0.4.10;
http://software.cisco.com/download/release.html?mdfid=282981372&softwareid=282487380&release=1.0.4.10
If nmap still shows the port opened, I then suggest you to disable the remote management to determine if this is the root of the problem, then contact the Small Business Support Center to have a TAC engineer figure this out;
https://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html
Please do not hesitate to reach me back if there is anything I may assist you with.
Kind regards,
Jeffrey Rodriguez S. .:|:.:|:.
Cisco Customer Support Engineer
*Please rate the Post so other will know when an answer has been found.

Mac OS X Leopard Firewall/default open ports rpcbind?

Hi,
I'm looking into hardening/securing mac os x leopard and noticed that port 111 rpcbind is open. Is rpcbind open by default? What are leopards default open ports on a fresh install?
Also is there any way to run openbsd/freebsd PF firewall?
Thanks!

This is what nmap reports:
Starting Nmap 4.76 ( http://nmap.org ) at 2009-03-02 12:28 EST
Warning: Unable to open interface vmnet8 -- skipping it.
Warning: Unable to open interface vmnet1 -- skipping it.
Interesting ports on localhost (127.0.0.1):
Not shown: 993 closed ports
PORT STATE SERVICE
111/tcp open rpcbind
631/tcp open ipp
1021/tcp open unknown
1022/tcp open unknown
1023/tcp open netvenuechat
2049/tcp open nfs
49152/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 10.55 seconds
nestat -a | grep LISTEN confirms:
tcp6 0 0 localhost.ipp . LISTEN
tcp4 0 0 *.49152 . LISTEN
tcp4 0 0 *.1021 . LISTEN
tcp4 0 0 *.1022 . LISTEN
tcp4 0 0 *.sunrpc . LISTEN
tcp4 0 0 *.nfsd . LISTEN
tcp4 0 0 *.1023 . LISTEN
tcp4 0 0 localhost.ipp . LISTEN
tcp6 0 0 localhost.ipp . LISTEN
Not too sure what netvenuechat is and I have no idea why NFS is open/running. I'm not connecting to any NFS shares. How do I lock everything down?
Any suggested IPFW rules?
Here is what 'ipfw show' returns:
3300 36 2160 deny icmp from any to me in icmptypes 8
65535 866558 351141790 allow ip from any to any
Thanks,
Juan

DPC3825 / CAN OPEN PORT 3306 BUT NOT OTHERS

I am trying to open port 80, 3306, 30000, and 30001 .... I did everything properly, I have a static IP address, I am hooked directly to my cisco router, but when I go to this website http://www.whatsmyip.org/port-scanner/ and scan to see if my ports are open, only port 3306 shows that is open, all the other ports time out... Please help me.

Hi Bertrude,
The DPC3825 is an internet service provider (ISP) supported product. You will need to contact them or your technology reseller from where you purchased the device to assist you with your question.

Cannot open Public Folder item: "Not enough memory available in Exchange"

Hi
We are running Exchange 2003 Sp2.
I cannot open an item in a Public Folder in Outlook that holds a list of contact details - the error message is;
"Error: Cannot open this item. There is not enough memory available on Microsoft Exchange to perform this operation. Contact your system administrator"
However, I can open the Contacts using Webmail. Any ideas?

Quote: “open an item in a Public Folder in Outlook that holds a list of contact details”
The item you said, is it a distribution list? If yes, please see KB 894530
Troubleshooting:
1.       Is the issue only happened on one item in the problematic public folder?
2.       Is the issue only happened on one public folder?
3.       Please recreate one same type item in the problematic public folder, see if the issue still persists
4.       Is the issue only happened via one outlook client? Please test if the symptom also occurs when we reproduce the issue in another PC with another user’s outlook profile
Resources:
If the outlook’s version is 2007, please see KB 945014

Opening attachments - ERROR MSG - 'Not enough memory or disc space'

Hi
I'm trying to open a word .doc from my Entourage email account and it comes up with the error message ' Not enough memory or disc space'. My hard drive has 119 GB free - so I'm thinking it may be a memory issue.
How do I deal with this/clean up my computer??
I just turned my computer on for the day and got this message. The only programs I've got running is Safari, entourage, word and adobe reader.
Thanks.
Margie

Have you tried Epson support for that E-Web Print application?
Also, I am curious if Epson installed an add-on for Firefox for that E-Web Print application? ''Thus prompting you to ask about it in the Firefox support forum.''
At this point the best I can offer you is a suggestion to reset your printer prefs in Firefox to see if that will help with that issue.
https://support.mozilla.org/en-US/kb/fix-printing-problems-firefox#w_reset-all-firefox-printer-settings

Pixel Bender will not open in PS CS5 (not enough RAM)

I get the following message when I try to open Pixel Bender in Photoshop CS5:
Could not complete the Pixel Bender Gallery command because there is not enough memory (RAM).
I have 4GB RAM on a Mac Mini 2gHz Core Duo, and I have never had another plug in fail to load. Requirements are supposed to be the same as CS5.
Any suggestions?

Thanks for your response.
Photoshop is running in 32-bit mode, as most of my plug ins are not yet 64 bit.
This error dialog appears before the gallery opens.
All my images are under 4096 px wide. I tried using a much smaller image. Same message.
I tried increasing the available memory in preferences. Same message.
I tried lowering the available memory in preferences. Same message.
My Mac Mini has an NVidia 9500M, which is listed as one of the cards that support GPU processing for Pixel Bender. Memory is shared with the CPU, but that should not be relevant - many others would have had my complaint if that mattered.

Cannot open Labview 7 without "not enough memory" error

I get the "not enough mempry to complete this operation" as Labview is opening. I have tried uninstalling everything and reinstalling. No good. There is 512 Mb in this system should be plenty to open Labview. Any ideas? Labview will also not open a vi. It says it cannot find it (the one I selected for it to open). It tries to load it and all subvi's but cannot get past the first vi.

I figure there are two possiblities. LabVIEW is poorly installed on your system causing the error or your VIs are corrupted. You can test the former by installing LabVIEW on another computer. If you can open the VIs there, consider contacting NI for ways to more throughly remove NI products from your machine. To test the latter, see if you can create new VIs in 7, save, close, and reopen them. You can also see if other VIs on your machine open. If your VIs are corrupted, then try to open them in your older LV, copy the Block Diagram over to a new VI, save, and open in LV 7.0. At the very least, you can get a screen shot of the diagram.
Good luck!!

RMI | Firewall issue revisited

Hi all,
I have searched through these forums for a suitable answer to my problem, but have not gotten any.
My RMI client-server app was working perfectly well on a Windows 2000 Advanced Server (with its firewall restrictions), until my company decided to buy another firewall appliance. My RMI server used to run on the Advanced server machine with a static IP and I ran my server with the following command :
java -Djava.security.policy=server.polocy -Djava.rmi.server.hostname=209.XXX.XXX.XXX Server
(209.XXX.XXX.XXX being the static IP used by the advanced server)
Now, with the addition of the firewall appliance and after having opened up 2 ports for RMI communication and forwarding them to the Host machine, my application had stopped functioning across the internet.
The host machine has an internal IP address of say 129.128.***.***
When an external client tries to establish contact with the my RMI server using 209.XXX.XXX.XXX (the external IP), I get a
"Connection refused: Unable to connect with 129.128.***.***"
This makes me believe that even though the client is able to initially establish connection with the RMI server, the RMI server sends back a reply to the client, asking it to find the server at the INTERNAL ip address.
Is there a way to avoid this ? Where am I going wrong ? How can I resolve this issue ?

The error is happening because the client is finding and connecting to the RMI registry OK, it is getting the Remote reference OK but when it tries to send a message to the Remote reference it is sending to your internal IP address and hence getting the unable to connect error.
The IP address in the Remote reference returned by the RMI registry is the one that the server object is bound to. No amount of port forwarding will change that.
You have two options in my experience:
1. You can try to force your server to believe it is 209.x.x.x when you bind the Remote instance. You can do this on Linux, but I have no idea how to do it on W2K.
2. The server.rmi.hostname works for fully qualified domain names, not IP addresses. If you only have one RMI server running, or if you use different ports for different RMI servers, you should be fine by setting the hostname value to your fully qualified domain name and then use NAT to forward to the Internal IP address. If you have more than one server running on the same port number, you'll need to register different FQDN's for each. Then all you need to do is update your internal DNS to point to the internal IP address and the external clients will use their existing DNS in the normal manner.

Airport Extreme-NAT-Firewall-TCP-IP-Ports and what not... I BEG FOR HELP!

Problem: I can't use ISPQ (videochat) with my ibookG4 or MacBookPro.
Details: iBookG4 [10.3.9] is the main one, MacBookPro [10.4.7] is the secondary one. I have a DSL modem attached to an Airport Extreme base.
===
I have run a diagnostic test on IsPq and this is the result:
Contacting server with HTTP protocol... success.
Connecting to diagnostic server... success.
Logging into diagnostic server... success.
Testing TCP port 2000 (VideoChat control)... failed.
Testing TCP port 2001 (VideoChat data)... failed.
Testing TCP port 2002 (Quick Message)... failed.
Results:
Your local address is 10.0.1.3, your address as seen by the rest of the world is 151.51.233.232, and your address as seen by our HTTP servers is 151.51.233.232. Your computer is configured to use the following DNS servers: 193.70.192.25, 193.70.152.25, 10.0.1.1.
This computer appears to be behind a NAT firewall, it cannot receive incoming connections. It can still use iSpQ VideoChat, but it will not be able to initiate VideoChat connections and quick messages will be delivered through the server.
If you are using the MacOS X firewall, add an entry for iSpQ VideoChat to allow connections on ports 2000-2002. If you have a router on your network, make sure it is configured to properly route TCP ports 2000-2002 to your computer at 10.0.1.3. Otherwise, contact your network administrator for assistance.
===
Please help me or I will start crying. I'm close to utter desperation.
Thanks,
Emmanuel

Thanks Rick, I was afraind nobody was going to reply.
Let me get this right. In my sharing options I have disabled firewall. So that bit is done. The next bit is about configuring my router, that is my dsl router (Castlenet AR250, I think).
My airport base has nothing to do with it, correct?
Thanks again...

Anyone else having issues opening port 1701 and 500?

on a standar actiontec fios router.
setting up VPN on a mac server, and port 1701 just wont open. I can open all other ports just fine, except for UDP1701 and 500
any guidance would be great!

TNS_2 wrote:
Defaulted to selected on my new version I. I never selected it. The router was only installed as part of my Quantum TV package. Only looked to comment about port forwarding.
p.s. I reset the router to factory defaults when I got it to make sure no junk from a previous user was present, and then changed the router password and turned off the wireless (I use my own router connected after the Verizon for wireless use).
Must be something wrong with your I router. they are not selected on mine which is only a couple of months old Firmware Version:40.21.10.3
Are you saying that all those rules defined under advanced, network, port forwarding rules are activated?
How did it decide what device/s on your internal network to forward to?

RMI firewall issue - opening port 1099 is not enough

Similar Messages

Maybe you are looking for