Configuring JBoss for use Behind a Firewall

JBoss comes with many socket based services that open listening ports. In this section we list the services

that open ports that might need to be configured to work when accessing JBoss behind a firewall. The following table, shows the ports, socket type, associated service and link to the service configuration for the services in the default configuration file set.

(a) This service binds to an anonymous TCP port and does not support configuration of the port or bind interface. Remove the rmi-il-service.xml to disable it NOTE: this RMI invoker service is deprecated since the beginning of 2005

(b) This service binds to an anonymous UDP port and does not support configuration of the port or bind interface. Remove the snmp-adaptor.sar to disable it

JBossMessaging will use these ports:

• Case you are using JBossMessaging in your configuration, you won't have any deploy/jms ports being used as described on the first table

Additional ports found in the all configuration:

One possible configuration for RMI through a firewall

NOTE: this was only tested in version 3.2.5 with java 1.4, but information in the forums indicate that this method has worked for several years.  Search for NAT to find related information.

Open three ports through your firewall, one for the naming service, a second for the naming service RmiPort, and a third for the jrmp RMIObjectPort.  These ports must be "fixed" on the system behind the firewall so that communications always happen on ports opened through the firewall.  This is done in the jboss-service.xml file.

   <mbean code="org.jboss.naming.NamingService"
      name="jboss:service=Naming">
      <!-- The listening port for the bootstrap JNP service. Set this to -1
        to run the NamingService without the JNP invoker listening port.
      -->
      <attribute name="Port">1099</attribute>
      <attribute name="RmiPort">1098</attribute>
   </mbean>

and

   <!-- RMI/JRMP invoker -->
   <mbean code="org.jboss.invocation.jrmp.server.JRMPInvoker"
      name="jboss:service=invoker,type=jrmp">
      <attribute name="RMIObjectPort">4444</attribute>
      <!--
      <attribute name="ServerAddress">${jboss.bind.address}</attribute>
      <attribute name="RMIClientSocketFactory">custom</attribute>
      <attribute name="RMIServerSocketFactory">custom</attribute>
      <attribute name="SecurityDomain">ssl-domain-name</attribute>
      -->

      <depends>jboss:service=TransactionManager</depends>
   </mbean>

Then, on the system behind the firewall, the following parameters need to be added to the java command line in the run.sh script to pass back the "correct" RMI information to the system outside of the firewall.  "Correct" in this case means the hostname that the outside system refers to when addressing the system behind the firewall.

    -Djava.rmi.server.hostname=<external_host_name>
    -Djava.rmi.server.useLocalHostname=true

NOTE: shouldn't it be -Djava.rmi.server.useLocalHostname=false since it should NOT return the local host name? Works here (4.2.2.GA) with set to false.

This solves the problem of the machine behind the firewall passing back it's local IP address that the machine outside the firewall cannot get to.  NOTE: this assumes a pretty simple setup where everything outside the firewall references the machine behind the firewall with the same host name.

In more complex configurations, it may be necessicary for the system running behind the firewall to be able to resolve

:1099" when the initial context is created for the RMI access.

PooledInvoker

When using the PooledInvoker the attribute "ClientConnectAddress"(jboss-service.xml) is the host name that clients will use to connect to the server. You might need to set this to a DNS name that can be resolved by remote clients. This will default to the hostname of the server running jboss which may not be accessible by remote clients.

To invoke services behin firewall or NAT you need to modify two file

jboss/server/default/deploy/ejb3.deployer/META-INF/jboss-service.xml

    <mbean code="org.jboss.remoting.transport.Connector" name="jboss.remoting:type=Connector,name=DefaultEjb3Connector,handler=ejb3">
       <depends>jboss.aop:service=AspectDeployer</depends>
      <attribute name="Configuration">
         <config>
            <invoker transport="socket">
               <attribute name="numAcceptThreads">1</attribute>
               <attribute name="maxPoolSize">300</attribute>
               <attribute name="clientMaxPoolSize" isParam="true">50</attribute>
               <attribute name="timeout" isParam="true">60000</attribute>
               <attribute name="serverBindAddress">${jboss.bind.address}</attribute>
               <attribute name="serverBindPort">3873</attribute>
                   <!-- that's the important setting -->
             <attribute name="clientConnectAddress">webaddress.com</attribute>
             <attribute name="clientConnectPort">3873</attribute>
               <attribute name="backlog">200</attribute>
            </invoker>
            <handlers>
               <handler subsystem="AOP">org.jboss.aspects.remoting.AOPRemotingInvocationHandler</handler>
            </handlers>
         </config>
      </attribute>
   </mbean>

and

/jboss/server/default/deploy/http-invoker.sar/META-INF/jboss-services.xml

 
<!-- The HTTP invoker service configration
  -->
  <mbean code="org.jboss.invocation.http.server.HttpInvoker"
    name="jboss:service=invoker,type=https">
     <!-- Use a URL of the form http://<hostname>:8080/invoker/EJBInvokerServlet
      where <hostname> is InetAddress.getHostname value on which the server
      is running.
      -->
     <attribute name="InvokerURL">https://webaddress.com:8443/invoker/EJBInvokerServlet</attribute>
     <attribute name="InvokerURLPrefix">https://</attribute>
     <attribute name="InvokerURLSuffix">:8443/invoker/EJBInvokerServlet</attribute>
     <!-- important to turn it off -->
     <attribute name="UseHostName">false</attribute>
  </mbean>


<!-- Expose the Naming service interface via HTTPS -->
<mbean code="org.jboss.invocation.http.server.HttpProxyFactory"
       name="jboss:service=invoker,type=https,target=Naming">
    <!-- The Naming service we are proxying -->
    <attribute name="InvokerName">jboss:service=Naming</attribute>
    <!-- Compose the invoker URL from the cluster node address -->
    <attribute name="InvokerURL">https://webaddress.com:8443/invoker/JMXInvokerServlet</attribute>
    <attribute name="InvokerURLPrefix">https://</attribute>
    <attribute name="InvokerURLSuffix">:8443/invoker/JMXInvokerServlet
</attribute>
    <attribute name="UseHostName">false</attribute>
    <attribute name="ExportedInterface">org.jnp.interfaces.Naming
</attribute>
    <attribute name="JndiName"></attribute>
    <attribute name="ClientInterceptors">
        <interceptors>
            <interceptor>org.jboss.proxy.ClientMethodInterceptor
     </interceptor>
            <interceptor>org.jboss.proxy.SecurityInterceptor
     </interceptor>
            <interceptor>org.jboss.naming.interceptors.ExceptionInterceptor
     </interceptor>
            <interceptor>org.jboss.invocation.InvokerInterceptor
     </interceptor>
        </interceptors>
    </attribute>
</mbean>

Referenced by: