Re: Getting App to use same port

From: Barry Margolin (barmar_at_alum.mit.edu)
Date: 09/21/04

  • Next message: Kushal Agarwal: "Re: Associating Unix User Accounts with Servers"
    Date: Mon, 20 Sep 2004 22:05:54 -0400
    
    

    In article <Xns956AB5FDDD8DBccruizermydejacom@64.164.98.50>,
     XXjbhuntxx@white-star.com (Cosmic Cruizer) wrote:

    > I have a Solaris 8 box located in a DMZ. There is an RPC application on the
    > box in the DMZ that needs to communicate with a box in our intranet. I've
    > opened the port through the firewall for the RPC call to go from the DMZ to
    > the intranet, but that is only half the battle. The application does not
    > always send from the same port, therefore, the return path may be different
    > each time. Since I am not allowed to open a wide range of ports, I need to
    > have the application use the same port each time.
    >
    > How can I setup the box in the DMZ to use the same port each time?

    There's no system-wide way to configure this, it's up to the
    application. Normally, client applications just let the system pick the
    next available port. Unless the application provides a configuration
    option to force a particular port, that's what will happen.

    You need a stateful firewall. When it sees the request packet, it will
    remember the source port and allow the replies back through.

    If you're using a Cisco router, I believe its CBAC mechanism can be used
    for this.

    -- 
    Barry Margolin, barmar@alum.mit.edu
    Arlington, MA
    *** PLEASE post questions in newsgroups, not directly to me ***
    

  • Next message: Kushal Agarwal: "Re: Associating Unix User Accounts with Servers"

    Relevant Pages

    • Re: Unable to join AD domain from DMZ network
      ... It was the RDC Dynamic high port blocking the traffic. ... "Paul Bergson" wrote: ... the server from the DMZ registered ... authentication from DMZ to 2003 AD internal network. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Unable to join AD domain from DMZ network
      ... the server from the DMZ registered the ... unless you lock it down to a specific port. ... authentication from DMZ to 2003 AD internal network. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Merge replication security
      ... I know port 1433 needs to be open for OUTBOUND traffic, ... By having a separate SQL server in the DMZ I can use Windows ... > connect to your SQL Server which is on your internal network. ...
      (microsoft.public.sqlserver.replication)
    • Which product is the best and/or requirements.
      ... LAN on the router with the following below features included, ... At minimum 2 ports, but more ports are welcomed, one port for WAN, one ... DMZ that is dedicated to processing those kind of stuff, ... so were not sure how much excess power draw will ...
      (comp.os.linux.embedded)
    • Re: Share Internet Connection with 2 SBS Same Router
      ... Sonic WAN ... but relies on the ISP being able to assign a 2nd public IP to the DMZ. ... Assign a subnet mask in the DMZ Subnet Mask field. ... WAN port on the router or a LAN port on the router? ...
      (microsoft.public.windows.server.sbs)