Problem with JMS behind firewall

[nickdegraeve]

When our client application tries to create a topic connection it times out.

We have a JBoss server on a machine on the local LAN and it is separated from the Internet by a router/firewall. On the router following ports are forwarded to the local IP address of the JBoss server: 1098, 1099, 4444, 8080 & 8093.

I started the server with -Djava.rmi.server.hostname=mail.fpc.be -Djava.rmi.server.useLocalHostname=false

However, in the JBoss MQ logging on the client I see "Connecting with addr=192.168.254.6, port=8093, localAddr=null", and that's the local LAN IP address.

Any idea on what is configured incorrectly?

Stacktrace :

com.fpc.nokeos.core.common.exceptions.NokeosRuntimeException: Er is een systeem fout opgetreden.<br>Gelieve de NoKeossysteemadministrator te contacteren.
 at com.fpc.nokeos.core.common.jms.ConnectionFactory.<clinit>(ConnectionFactory.java:34)
 ... 14 more
Caused by: org.jboss.mq.SpyJMSException: Cannot authenticate user; - nested throwable: (java.net.Con
nectException : Connection timed out: connect)
 at org.jboss.mq.SpyJMSException.getAsJMSException(SpyJMSException.java:78)
 at org.jboss.mq.SpyJMSException.rethrowAsJMSException(SpyJMSException.java:63)
 at org.jboss.mq.Connection.authenticate (Connection.java:1069)
 at org.jboss.mq.Connection.<init>(Connection.java:252)
 at org.jboss.mq.Connection.<init>(Connection.java:323)
 at org.jboss.mq.SpyConnection.<init>(SpyConnection.java :116)
 at org.jboss.mq.SpyConnectionFactory.internalCreateConnection(SpyConnectionFactory.java:137)
 at org.jboss.mq.SpyConnectionFactory.createTopicConnection(SpyConnectionFactory.java:118)
 at com.fpc.nokeos.core.common.jms.ConnectionFactory .<clinit>(ConnectionFactory.java:31)
 ... 14 more
Caused by: java.net.ConnectException: Connection timed out: connect
 at java.net.PlainSocketImpl.socketConnect(Native Method)
 at java.net.PlainSocketImpl.doConnect (Unknown Source)
 at java.net.PlainSocketImpl.connectToAddress(Unknown Source)
 at java.net.PlainSocketImpl.connect(Unknown Source)
 at java.net.SocksSocketImpl.connect(Unknown Source)
 at java.net.Socket.connect (Unknown Source)
 at java.net.Socket.connect(Unknown Source)
 at java.net.Socket.<init>(Unknown Source)
 at java.net.Socket.<init>(Unknown Source)
 at javax.net.DefaultSocketFactory.createSocket (Unknown Source)
 at org.jboss.mq.il.uil2.UILServerIL.createConnection(UILServerIL.java:670)
 at org.jboss.mq.il.uil2.UILServerIL.getSocketMgr(UILServerIL.java:558)
 at org.jboss.mq.il.uil2.UILServerIL.authenticate (UILServerIL.java:360)
 at org.jboss.mq.Connection.authenticate(Connection.java:1065)
 ... 20 more

Additional logging on JBoss MQ:

2007-05-08 11:25:15,859 - DEBUG: [org.jboss.mq.referenceable.SpyConnectionFactoryObjectFactory] Extracting SpyConnectionFactory from reference
2007-05-08 11:25:15,953 - DEBUG: [org.jboss.mq.referenceable.SpyConnectionFactoryObjectFactory] The GenericConnectionFactory is: GenericConnectionFactory[server=org.jboss.mq.il.uil2.UILServerIL@1343ed0 connectionProperties={ClientILService=org.jboss.mq.il.uil2.UILClientILService, UIL_TCPNODELAY_KEY=yes, UIL_CHUNKSIZE_KEY=1000000, UIL_CONNECTADDRESS_KEY=null, UIL_CONNECTPORT_KEY=0, UIL_SOTIMEOUT_KEY=120000, UIL_RECEIVE_REPLIES_KEY=No, UIL_ADDRESS_KEY=192.168.254.6, UIL_PORT_KEY=8093, PingPeriod=60000, UIL_BUFFERSIZE_KEY=2048}]
2007-05-08 11:25:15,984 - DEBUG: [org.jboss.mq.Connection] Setting the clockDaemon's thread factory
2007-05-08 11:25:16,000 - TRACE: [org.jboss.mq.Connection] Connection Initializing userName=null Connection@9492714[clientID=null rcvstate=STOPPED]
2007-05-08 11:25:16,000 - TRACE: [org.jboss.mq.Connection] Getting the serverIL Connection@9492714[clientID=null rcvstate=STOPPED]
2007-05-08 11:25:16,000 - TRACE: [org.jboss.mq.Connection] serverIL=org.jboss.mq.il.uil2.UILServerIL@19113f8 Connection@9492714[clientID=null rcvstate=STOPPED]
2007-05-08 11:25:16,000 - TRACE: [org.jboss.mq.Connection] Authenticating user null Connection@9492714[clientID=null rcvstate=STOPPED]
2007-05-08 11:25:16,000 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Begin connect loop, maxRetries=10, delay=0
2007-05-08 11:25:16,000 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Connecting with addr=192.168.254.6, port=8093, localAddr=null, localPort=0, socketFactory=javax.net.DefaultSocketFactory@542529, enableTcpNoDelay=true, bufferSize=2048, chunkSize=1000000
2007-05-08 11:25:37,062 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Begin connect loop, maxRetries=10, delay=0
2007-05-08 11:25:37,062 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Connecting with addr=192.168.254.6, port=8093, localAddr=null, localPort=0, socketFactory=javax.net.DefaultSocketFactory@542529, enableTcpNoDelay=true, bufferSize=2048, chunkSize=1000000
2007-05-08 11:25:58,187 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Failed to connect, retries=1
java.net.ConnectException: Connection timed out: connect
 at java.net.PlainSocketImpl.socketConnect(Native Method)
 at java.net.PlainSocketImpl.doConnect(Unknown Source)
 at java.net.PlainSocketImpl.connectToAddress(Unknown Source)
 at java.net.PlainSocketImpl.connect(Unknown Source)
 at java.net.SocksSocketImpl.connect(Unknown Source)
 at java.net.Socket.connect(Unknown Source)
 at java.net.Socket.connect(Unknown Source)
 at java.net.Socket.<init>(Unknown Source)
 at java.net.Socket.<init>(Unknown Source)
 at javax.net.DefaultSocketFactory.createSocket(Unknown Source)
 at org.jboss.mq.il.uil2.UILServerIL.createConnection(UILServerIL.java:670)
 at org.jboss.mq.il.uil2.UILServerIL.getSocketMgr(UILServerIL.java:558)
 at org.jboss.mq.il.uil2.UILServerIL.connectionClosing(UILServerIL.java:403)
 at org.jboss.mq.Connection.<init>(Connection.java:264)
 at org.jboss.mq.Connection.<init>(Connection.java:323)
 at org.jboss.mq.SpyConnection.<init>(SpyConnection.java:116)
 at org.jboss.mq.SpyConnectionFactory.internalCreateConnection(SpyConnectionFactory.java:137)
 at org.jboss.mq.SpyConnectionFactory.createTopicConnection(SpyConnectionFactory.java:118)
 at com.fpc.nokeos.core.common.jms.ConnectionFactory.<clinit>(ConnectionFactory.java:31)
 at com.fpc.nokeos.core.client.launch.Launcher$Licensor.<init>(Launcher.java:491)
 at com.fpc.nokeos.core.client.launch.Launcher.doLogin(Launcher.java:145)
 at com.fpc.nokeos.core.client.launch.Launcher.main(Launcher.java:134)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 at java.lang.reflect.Method.invoke(Unknown Source)
 at com.sun.javaws.Launcher.executeApplication(Unknown Source)
 at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
 at com.sun.javaws.Launcher.continueLaunch(Unknown Source)
 at com.sun.javaws.Launcher.handleApplicationDesc(Unknown Source)
 at com.sun.javaws.Launcher.handleLaunchFile(Unknown Source)
 at com.sun.javaws.Launcher.run(Unknown Source)
 at java.lang.Thread.run(Unknown Source)
2007-05-08 11:25:58,187 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Connecting with addr=192.168.254.6, port=8093, localAddr=null, localPort=0, socketFactory=javax.net.DefaultSocketFactory@542529, enableTcpNoDelay=true, bufferSize=2048, chunkSize=1000000
2007-05-08 11:26:19,296 - TRACE: [org.jboss.mq.il.uil2.UILServerIL] Failed to connect, retries=2
java.net.ConnectException: Connection timed out: connect
[...]

[nickdegraeve]

Resolved it myself.

I came across the Wiki page http://wiki.jboss.org/wiki/Wiki.jsp?page=ConfigUIL2 where it said in the section "JMS client properties for the UIL2 transport":

org.jboss.mq.il.uil2.serverAddr: This system property allows a client to override the address to which it attempts to connect to. This is useful for networks where NAT is ocurring between the client and JMS server.

So adding following to my JNLP file fixed it:

<property name="org.jboss.mq.il.uil2.serverAddr" value="mail.fpc.be"/>

[yangju]

I wish I found this thread earlier. We figured it out the hard way(moments prior to production is started). I thought that we only needed to configure the jboss server to use NAT address. It turns out (as described above), we had to force the jms client to use NAT address also. I just don't understand why? Doesn't the server tells the client where to connect? Why does the client has to force it?
Also, if we upgrade to jboss messaging in the future, do we have the same issues here?

Another question, why jbossMQ has to do so many port redirecting and forwarding, for example from 1099 to 1098 to 8083 to 8084. This created a headache for firewall config. Weblogic does not have this problem.

Does jboss messaging do these redirecting and forwarding too?

Please let me know.

Thanks.

[michel.d]

Hello,
I have exactly the same problem on using JMS with JBoss behind a firewall.
Your solution seems to be good, but I don't use a JNLP file, so where can i define the org.jboss.mq.il.uil2.serverAddr property?
I tried to define it in my InitialContext properties but it didn't work...

Thanks by advance,
Michel D.

[kahzoo]

The wiki indicates that it is one of the "system properties that a JMS client using the UIL2 transport can set".

So you should be able to define it on the JMS client side as below:

java -Dorg.jboss.mq.il.uil2.serverAddr=...

[unnijboss]

I have a question here.

Does ConnectAddress and ConnectPort attributes in uil2-service.xml
for the same purpose. These will be passed on to client to connect back to the server.