Rmi/iiop with clients behind firewall?

Question

I have a client app (standalone/applet) that will be running behind a firewall and I'm trying to connect it to S1AS7 through rmi/iiop. I keep getting some connection exceptions on the server when it tries to connect back to the client. Is there anyway to find out which port the server tries to connect to the client so I can open up that port with the firewall? Is there any other workarounds?

Answer 1

Check out the below document. This is a document for the earlier version of the appserver, but I guess this part should still hold good in S1AS 7 :
http://docs.sun.com/source/816-5777-10/jpgrichc.htm#24425
Basically, during the RMI-IIOP communication, the ports are assigned dynamically and hence we cannot exactly say which ports will be used for the response.
As a general rule of thumb, the response will be going through the ephemeral ports. (Ephemeral ports are temporary ports assigned by a machine's IP stack, and are assigned from a designated range of ports for this purpose. When the connection terminates, the ephemeral port is available for reuse, although most IP stacks won't reuse that port number until the entire pool of ephemeral ports have been used. So, if the client program reconnects, it will be assigned a different ephemeral port number for its side of the new connection.)
So, it is advisable to open the the entire ephemeral port range in the firewall.
On Solaris, the ephemeral port range can be determined using the below command :
# /usr/sbin/ndd /dev/tcp tcp_smallest_anon_port tcp_largest_anon_port
These values could also be altered using the below commands :
# /usr/sbin/ndd -set /dev/tcp tcp_smallest_anon_port 49152
# /usr/sbin/ndd -set /dev/tcp tcp_largest_anon_port 61000
Hope that helps...
Cheers,
VM