RMI server behind firewall--must use host as name, not IP

Question

Server is running behind a firewall, which runs such that any machine behind the firewall cannot use the external IP to get back to itself.
That is:
- outside IP = 192.171.20.5 (port forwards 1099 to 192.168.1.5:1099)
- inside IP = 192.168.1.5 (rmi server listens on 1099)
from the machine inside (192.168.1.5), it is IMPOSSIBLE to create a socket to [outside ip](192.171.20.5), port 1099, and expect it to get back to the machine inside--the firewall prohibits this.
I -can- use name-based lookups, such that I can edit the hosts file on the inside box to route (myhost.com to 192.168.1.5). So, if everyone's DNS resolves myhost.com -> 192.171.20.5, then clients anywhere can go to myhost.com:1099 and will be redirected to my internal machine (192.168.1.5:1099).
The problem with this is that the names get translated to IPs and sent back to the client.
Is there a way to keep the names as names, so that both client (using external real-world DNS entries) and server (using local hosts file) can both resolve to the proper IP addresses?
I'm starting server, as follows:
java -Djava.rmi.server.codebase=http://myhost.com/rmi/ -Djava.security.policy=/policypath/policy -Djava.rmi.server.hostname=myhost.com mypkg.myclass
The client connects and gets this message (from a connection exception):
java.rmi.ConnectException: Connection refused to host: 192.168.1.5;

Answer 1

Server is running behind a firewall, which runs such
that any machine behind the firewall cannot use the
external IP to get back to itself.I dont really understand this statement.. Machines behind the firewall referring to the external ip would be going to the gateway, not themselves.. Or do you have an internal AND external ip on the machines behind the firewall? Or are we referring to the gateway machine as an internal machine as well as external?
That is:
- outside IP = 192.171.20.5 (port forwards 1099 to
192.168.1.5:1099)
- inside IP = 192.168.1.5 (rmi server listens on
1099)looks good, what kinda OS/firewall? If we're talking linux/ipchains (or iptables) with ip masquerading, I may be of some use to you...
from the machine inside (192.168.1.5), it is
IMPOSSIBLE to create a socket to [outside
ip](192.171.20.5), port 1099, and expect it to get
back to the machine inside--the firewall prohibits
this.If you're on the internal network, why can't you just go for the internal ip addr? If I'm understanding correctly, you want internal dns requests for myhost.com to resolve to 192.168.1.5, and external dns requests to resolve to 192.171.20.5? That should't be a problem...
I -can- use name-based lookups, such that I can edit
the hosts file on the inside box to route (myhost.com
to 192.168.1.5). So, if everyone's DNS resolves
myhost.com -> 192.171.20.5, then clients anywhere can
go to myhost.com:1099 and will be redirected to my
internal machine (192.168.1.5:1099).the hosts file has nothing to do with routing, it's simply a dns-type thing... If your dns is giving external users a 192.168 address as the ip for myhost.com, they will never get to it. 192.168 is not routable on the internet, i think most inet routes will drop packets from 192.168.x.x or 10.x.x.x.
Is there a way to keep the names as names, so that
both client (using external real-world DNS entries)
and server (using local hosts file) can both resolve
to the proper IP addresses?As long as your dns is working correctly, java doesn't care if you use ips or host names.. Hostnames are preferable, so when you change your network around, you wont affect your rmi server.
I'm starting server, as follows:
java -Djava.rmi.server.codebase=http://myhost.com/rmi/
-Djava.security.policy=/policypath/policy
-Djava.rmi.server.hostname=myhost.com mypkg.myclass
The client connects and gets this message (from a
connection exception):
java.rmi.ConnectException: Connection refused to host:
192.168.1.5;Is your server compiled with the 192.171 ip? That's not gonna work, you have to use the same IP the server is running on. I'm still not clear on your network layout, is 192.171.20.5 and 192.168.1.5 the 2 gateway ip's, or is 192.168.1.5 a physically different machine? I'd be willing to bet that your server is compiled with the external address, and if that's not the same machine, then there's no chance of that working....
There's more than port forwarding going on.. IIRC, java rmi keeps track of its own ip's.. A client request to an external ip will not connect to a server running on the internal ip, even if you forward the port, rmi itself doesn't recognize the internal as the ip it's trying to get to (even if it is true), so it bombs out.. This can happen if you run the rmi server on a gateway, and compile the server with the external ip, and try to connect to the internal ip.. If you want external machines to connect, you MUST run the server on an external ip.
Give a little more info, we'll getcha running... I'm also assuming you have full control of your network (ie, firewall/dns)
doug