RMI through a firewall

Has anybody been able to do this. I have an RMI server that will attach on a non-firewalled machine but won't on the machine I really need it on. Can anyone tell me what needs to be done admistratively or programmactically?
Steve

I looked into RMI over a firewall once.
The port 80 solution, called Http Tunnelling, at the time ( 2 years ago ) required a custom servlet intercepting all the RMI calls, then it forwarded the call on to the actual RMI server..... messy.
In the end I recommened writing an RMI Custom Socket Factory.
Not as hard as it looks, and source is available.
It meant that you could have your own properties file which dictated the ports the RMI used. So you might have something like
rmi_ports=1900-2000
You parse the properties file, and only attempt to open ports in that range.
The firewall will off course have to open that range of ports too.
I never implemented this, but did research it a few years back.
Maybe there's a more up-to-date solution.... maybe not.
But that's my 2 cents ( in Euro not dollars ! )
regards,
Owen
http://java.sun.com/j2se/1.5.0/docs/guide/rmi/socketfactory/index.html

Similar Messages

RMI Through Firewalls

Its possible make RMI calls Through Firewall if the ports 1099 and 1098 are open???
or its necessary applies the tunneling solution to pass through the firewall??

well well... rmi is really bad for this. But this can be achieved...
problem is, i think, that this server behind the firewall has private IP. So, when You register your server object, then registry knows, that it locates on private IP... and registry tells this information also to clients from outside networks (who connected originally to public ip).
I did a nasty hack, using custom client socket factory. I ignore ip address, that is passed to the createSocket method. There I just use my preferred IP. Being more exact: cause this createSocket method is invoked on client side, I ask this IP from client's static method (and this method returns me IP, where client originally connected). So, now my server is available from everywhere, cause createSocket uses that IP, which was used looking up registri at the beginning.
I am not happy with this, but... what else can I do? Most servers are behind firewall and does not have public IP... unfortunately, RMI developers don't get it :(

Portal access through a firewall

Hi there!
Having the default installtion of R2 on a single W2K box, what's the minimal procedure to make this configuration available through a firewall?
I've opened ports 7777-7778 but fail when trying to logon via SSO (host.domain.com:7777/pls/orasso)
Have I missed out to open another port or am I forced to follow the steps of setting up a reversing proxy to have portal-access outside the firewall?
Cheers
/Staffan

If they are on different servers, then both are listening on the 7777 port, and you will have to change one of them to use another port (assuming your firewall can only port forward a port to only one host).
If you are running both instances on the same server, then your SSO is accessible via 7777 and your midtier would be on 7778, so your setup as described should be enough (I do the same thing).
If they are running on the one machine, can you access the SSO/INF server directly? http://inf.domain.com:7777 and then http://inf.domain.com:7777/pls/orasso ?

Solaris 10 ssh through a firewall

I have Solaris 10 up and running on an HP Vectra. Everything is fine until I attempt to ssh through my firewall from the outside world.
I can ssh from my linux systems on the lan. But when I attempt to ssh from outside using either putty or ssh on another solaris 10 system the connection times out.
Anyone else experience a similar problem? Many thanks in advance.
John Wright
Asst Professor
CIT
Bellevue University

It's hard to tell what's going on without some more information. Here're a few things you can try:
Run "ssh localhost" from the Solaris box and make sure that works.
ssh to the Solaris box from another box on the same network segment.
From the site that doesn't work, do "ssh -v solaris_box" and see if that gives you any clues.
After trying to ssh from outside, do a "netstat -an |grep -i '*.22' and see the state of the TCP connection
(or if the first packet never even makes it).
Run sshd on the Solaris box with with the "-d" debug option.

Workstation Clients through a Firewall

Does anyone out there know if there are any issues with workstation clients going
through a firewall?
Thanks!
mervin

We have done it successfully from NT to a Unix server over afirewall. Its a case
of getting the WSNADDR set up correctly.
use the -H option in the WSL entry in ubb config shows to set it up.
eg
CLOPT="-A -- -d /dev/tcp -n 0x0002nnnnxxxxxxxx -H 0x0002MMMMyyyyyyyy"
Where nnnn is a port number
xxxxxxxx is the true hex IP address of the server
yyyyyyyy is the firewall hex address of the server
MMMM is fixed.
WSNADDR on the PC is set to port number and firewall address.
I know the hex notation is a bit out of date these date but it works fine for
us.
Hope it helps
Sue
"Mervin Calverley" <[email protected]> wrote:
>
Does anyone out there know if there are any issues with workstation clients
going
through a firewall?
Thanks!
mervin

Whenever I try to open up Firefox, it says that it's unable to connect, however, my internet connection is fine and I can still open up Internet Explorer. I already allowed Firefox through my firewall.

My internet connection is fine, I already allowed Firefox through my firewall. This is the first time it had ever happened and it happened suddenly, out of nowhere.

Try "Firefox connection settings" in [[Server not found]]
You can find the connection settings in Tools > Options > Advanced : Network : Connection<br />
If you do not need to use a proxy to connect to internet then select No Proxy
You can also try to remove all rules for Firefox from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox and the plugin-container process.
See:
* [[Server not found]]
* [[Firewalls]]

Endpoint on DMZ interface (through the firewall)

Hi
I have an ASA which connects to a BT Inifinty router. The address on the outside interface is dynamic. BT provide us with 5 static addresses (No NAT 5) which are routed to the outside interface but are a different subnet.
I would like to terminate the site to site VPN using one of the static IP addresses rather than the outside dynamic address.
Can I NAT the public static address to the DMZ interface (or any interface for that matter) and terminate the VPN on that interface i.e. the firewall is terminated through the firewall?
Thanks
Stuart
Update: A few people have looked but no answer. Is there some detail I need to add?

Matheus.Omega.Mendes wrote:
Well one solution that they found was implements one hollow interface called InterfaceWeb, just to mark the classes that works on web and desktop, although our system isn't perfectly object oriented, this solution was the worst that I ever seen. At least I think this way and I'd like to know if someone agree, disagree or have some explication for this choose.Hard to say without actually seeing it. Probably not a good idea.
Presumably the design was driven by time to market and cost rather than just because the developers didn't want to refactor.
As per the other suggestion, normally besides breaking the layers out you could share common functionality with a layer of its own (or several)

How to allow Flash, Reader, and Shockwave installations through the firewall?

When I allow a single machine to full access through the firewall on port 80, all three products install flawlessly. I am trying to narrow this down and only open the specific IP ranges used by adobe. Does anyone know which ones need to be allowed for this to work? Also, I do know about the standalone files that can be downloaded and then installed to avoid the firewall issue, but I would like to allow all users who bring their own devices to install these products. With the below IP address open through port 80, I am able to install Flash almost every time, but Reader and Shockwave are less reliable. Thank you for any help you can provide.
Bill
23.67.250.122
23.67.250.129
23.67.250.104
23.67.250.147
23.15.7.153
23.15.7.130
23.15.7.160
23.15.7.99
23.15.7.155
23.15.7.113
23.15.8.203
23.57.1.169
23.57.3.235
23.67.250.88
23.57.2.70
8.10.179.247
66.235.147.77
96.17.160.72
96.17.160.18
192.150.16.58
192.150.16.64
193.104.215.66
199.167.187.72

I have a method that works for FLASH player, but am trying to come up with a method for the other 2 myself. To automate flash player, I created a Policy and added the following:
Under Computer Config, Prefrences, Windows Setting, Files I created a new File Item.
I set Action = Replace, Created a Source File named mms.cfg* (more below) and have the destination file as systemroot%\System32\Macromed\Flash\mms.cfg (or %systemroot%\SysWOW64\Macromed\Flash\mms.cfg for x64)
I used notepad to edit the mms.cfg, and used the following in the body:
AutoUpdateDisable=0
SilentAutoUpdateEnable=1
AutoUpdateInterval=0
My non-admin users now update flash in the background silently and automatically.

Firewall Rules for Printing and Scanning through Windows Firewall

Hello,
I am having trouble determining the Ports, Programs, and Services required for printing and scanning with my AIO.
I am using Windows Firewall in Windows 7, and am only allowing certain rules in and out.
I know the firewall is the problem, for when I disable it, everything works fine.
Which rules are required for printing and scanning through the firewall?

4th Bump,
Is there anyone who can help me with this?
As I said before, other printer manufacturers such as Lexmark and Brother provide this exact information.
Why doesn't hp have a document for this? Does everyone just disable their firewall or open every port?

Cisco 8851 phones registering through Checkpoint firewall

We have a customer with a secured network, using Checkpoint firewalls and have a VPN site-to-site tunnel between our Cisco ASA and their Checkpoint firewall, with Cisco phones on the far side of the tunnel and CallManager 8.6 behind the ASAs. We have all the proper network ports referenced, but cannot get either a new Cisco 8851 (SIP) or a Cisco 7942 phone to register. The 8851 phone, when it tries to register, uses the 6970 port for distributed TFTP via HTTP first (by design), followed by TFTP/69. The 7900 phone never generates TFTP on port 69 at all. What is also strange is that the source port 5060 on the 8851 phone seems to be masked with an upper ephemeral network port (51566) when the request traverses the network, regardless of it passing through the firewall or a router. I know that TFTP uses UDP, but there is nothing in the docs that state it uses these upper port ranges?
Is this behavior normal for a Cisco SIP-based phone, and with the Skinny phone, is there something with Checkpoint firewalls that causes issues with Cisco VOIP phones. I have done key-word searches on the Forum for this issue, but have not found anything significant. I have also looked at the Nokia support forum, and saw some briefs, but it didn't directly describe our issue. Any help would b e greatly appreciated.
Thanks,

Hi Andrew
The attached document may assist:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/port/7_0/CCM_7.0PortList.pdf
A lot depends on topology etc, and the handset registration protocol you are using (SIP vs SCCP).
Hope this helps.
Barry Hesk
Intrinsic Network Solutions

RMI Clients behind firewall

When the RMI client behind firewall tries to access the server the following error is thrown up:
java.rmi.ConnectIOException: Exception creating connection to: 10.130.12.128; ne
sted exception is:
java.net.NoRouteToHostException: Operation timed out: no further informa
tion
java.net.NoRouteToHostException: Operation timed out: no further information
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.PlainSocketImpl.doConnect(Unknown Source)
at java.net.PlainSocketImpl.connectToAddress(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.Socket.<init>(Unknown Source)
at java.net.Socket.<init>(Unknown Source)
at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(Unknown S
ource)
at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(Unknown S
ource)
at sun.rmi.transport.tcp.TCPEndpoint.newSocket(Unknown Source)
at sun.rmi.transport.tcp.TCPChannel.createConnection(Unknown Source)
at sun.rmi.transport.tcp.TCPChannel.newConnection(Unknown Source)
at sun.rmi.server.UnicastRef.invoke(Unknown Source)
at RMIFaxServer_Stub.getResult(Unknown Source)
at FaxTest.main(FaxTest.java:51)

your client is behind the firewall but the server you're trying to access has an address 10.x.x.x which says that it too is behind a firewall and not on the Internet, or is the server in a DMZ. It sounds more like a networking issue than a java problem at this point. If the server is on some side of a firewall, you may need a some sort of "permit established" config setting added to the firewall. Just a thought.

Dont think RMi is HTTP tunneling through proxy firewall

Hi Guys,
Does anyone know how to monitor if RMI is using the option toHTTP tunnel through a proxy ???
Many of clients sit behind firewalls/proxies that enable HTTP only. I thought RMI would, as a default, use HTTP tunneling POST, RESPONSe methods to get through, but it does not.
Would that case be insted of using Naming.lokup("RMIServer"); that i should use
Registry reg = LocateRegistry.getResgistry(serverAddress, serverPort);
reg.lookup("RMIServer");
Any help would be greatly appreciated.

RMI doesn't have an option like that. Sockets do, and you get it for any socket including RMI by setting socksProxyHost and socksProxyPort.
The RMI HTTP tunnelling thing happens when there is an HTTP server at the server side. which redirects the request to an RMI server via rmi-cgi.cgi or the RMI servlet. It's automatic, as a fallback, and you can enforce its use via a system property which you can find in the Javadoc Guide to Features/Remote Method Invocation/Useful java.rmi system properties.

RMI through firewall

I want to know if RMI http tunniling works fine, or if it is hard to do.
Before I start to testing, I need to clarify some doubts.
Why JDK windows distribution doesn't have java-rmi.cgi file for http tunneling?
The bin directory has a file java-rmi.exe that I don't know what it does. I couldn't find many information about this.

Because you should use the RMI servlet that comes in the samples.

RMI (Internet, LAN, Firewall)

Hello everybody.
In the last view days I solved a lot of problems with my RMI based System... There was the registry problem, the IE problem (no RMI support), the access permission problem and so on...
But now everythiung is working properely. I use the Java Plug-In (JRE), so I don't even mind about Microsoft's Java implementation :-)
The registry is working, the server is working and the applet is working, too.
The problem I had is that I couldn't connect to my RMI server from the Internet... the applet could only connect from a LAN-host. The server is running on 192.168.0.1 and I could only connect from hosts like 192.168.*.*.
So I changed the rmiregistry command line:
"rmiregistry &"
to
"rmiregistry -J-Djava.rmi.server.hostname=myhost.net &"
and the server command line:
"java -Djava.rmi.server.codebase=http://myhost.net/msg/ -Djava.security.policy=server.policy MessageServer &"
to
"java -Djava.rmi.server.codebase=http://myhost.net/msg/ -Djava.security.policy=server.policy -Djava.rmi.server.hostname=myhost.net MessageServer &"
("myhost.net" is just a reference for the real domain name)
Now, I can connect the server from outside (Internet) but if I try to connect from the LAN (192.168.*.*) I get an Exception:
java.security.AccessControlException: access denied (java.net.SocketPermission 192.168.0.1:5099 accept,resolve)
Per haps there is a firewall problem. I connect to the internet unsing the gateway (firewall) 192.168.0.1 (which is also the RMI and webserver) and I opened the port 1099 for RMI (but in the exception above there is always another port, for example 5099, 5100, 5101, 5102, 5103) and it looks as if the applet tries to connect on different ports... first for example 4800, then 4801, 4802 and so on (and I really can't open alle these ports).
What should I try... I'm new to RMI and I don't have much experience in using RMI and handling ports, hosts, codebases etc. Is there a possibility to allow the access to the registry/server from LAN AND Internet or what can I do. Is there a possibility to tell the client/server to connect to a fix port (for example 5099) so I would open this port on my firewall.
Please give me some advice... I would be very grateful.
Thanks a lot.
Greetings
Adrian R.
Switzerland

If you look back through this forum you will find LOTS of discussion about operating through firewalls. A lot of it is problems with callbacks. Ignore it (unless this is the next problem you have to tackle.)
The probelm is about as you guessed: The actual communications from client to server program require a socket, and that's a problem unless you can nail down fixed ports and open them in the firewall. (There is supposed to be an automatic workaround built into RMI to use HTTP tunnelling. This may work - I just have no experience using it.)
One basic technique for solving the problem you posted is to define and set a "socket factory" that will provide fixed addresses for the communications.
As I said, look back through earlier postings.

Java Rmi Client behind firewall

What port should be opened to let rmi traffic passing through firewall to weblogic app server?

Dahan <[email protected]> writes:
What port should be opened to let rmi traffic passing through firewall to weblogic app server?The port the server is listening on?
andy

RMI through a firewall

Similar Messages

Maybe you are looking for