Firewall configuration for JBoss

[mikestephen]

Hi guys,

I am trying to figure out which ports to open up on a
firewall, to allow a java client to call a method on
a stateless session bean. I am running JBoss3.0.4, and
can see through the JMX Console that the bean is deployed
fine.

It seems that I need to open up 1099 for JNDI, 4444 for
RMI, and using port sniffer software I found a mystery
port that keeps changing each time I restart the server.

Does anyone know a way of fixing the mystery port to be
the same port each time, as then I could just open up
this port on the firewall.

I know that the java client - session bean works because
I have run it on 2 machines inside the firewall no
problems.

Any ideas?

Thanks,

Mike.

[ppovse]

Hi Mike!

I had the same problem.
JBoss is using an anonymous RMI-Port. The port number changes everytime you restart JBOSS. (Under UNIX you can see this with netstat -l)
But you can set the port by inserting a property in the <JBOSS_DIST/server/???/conf/>jboss-service.xml:
.
.
.
<!-- ==================================================================== -->

<!-- The invokerServletPath property gives the public URL to the
org.jboss.invocation.http.servlet.InvokerServlet used by the
HTTP proxy for RMI/HTTP. This is only needed if the http-invoker.sar
is deployed.
-->

invokerServletPath=http://localhost:8080/invoker/JMXInvokerServlet
>>>> jnp.rmiPort=34159

<!-- Load properties from each of the given comma seperated URLs

.
.
.

Have marked the line with >>>>
Now JBOSS will listen on port 34159.
I don't know if this is the right way to do this, but it works fine.

But know I have got another problem which could be yours too:
My Jboss-Webserver (with the local IP 192.168.1.3) is behind a firewall/router (with one static IP).
The firewall accesses the server via NAT (by translate the ports 1099,4444,and the jnp.rmiPort).
Contacting the jboss-server from other computer in the local net works. But when I try to connect
the Server from the internet it fails with an error like this:

javax.naming.CommunicationException [Root exception is java.rmi.ConnectException:
Connection refused to host: 192.168.1.3; nested exception is:
java.net.ConnectException: Verbindungsaufbau abgelehnt]

For me this seem that the initial connection to the server is ok. But then the server answers with
its own IP (maybe from the /etc/hosts), which is a local IP address.
With this local IP the client cannot do any further connection!

If I change the webservers IP to the static IP, the server can be addressed from the internet but
no longer from the local net. Isn't it funny?!

Does anybody have an idea ?

[mikestephen]

Hi,

Thanks very much for your help on fixing the port number!

The next problem you seem to be having, we had too and
this is how we fixed it (after searching the forums):

In your run.sh or run.bat, change the following line:

JAVA_OPTS="$JAVA_OPTS -Dprogram.name=$PROGNAME"

to:

JAVA_OPTS="$JAVA_OPTS -Dprogram.name=$PROGNAME
-Djava.rmi.server.hostname=aaa.bbb.ccc
-Djava.rmi.server.useLocalHostname=false"

where aaa.bbb.ccc is the externally visible domain name
of the firewall machine that will be doing the forwarding
to the internal jboss server. You might be able to put
the IP address of the firewall machine in there instead,
I'm not sure.

Thanks again for your help on this, and best of luck.

Mike.

[nagjboss]

Hi,
I am facing the prolem of this Dynanmic port getting created by the Server.. in JBoss2.4.4 do you have any solution on how to do it in JBoss2.4.4

[neil1]

We use tomcat hosted elsewhere to talk to our windows xp JBOSS 3.0.4 ejb in our network behind a router.
I have set the jnp.rmiPort to 34159 in jboss-service.xml so I could open and forward the port to the JBOSS box.
Also ports 4444, 8070, and 1476 are forwarded to this JBOSS box.
Also use -Djava.rmi.server.hostname=xx.xxx.xxx.xxx -Djava.rmi.server.useLocalHostname=false
These settings allowed lookup of the a jboss queue using a test jsp page.

Another test page that tries to lookup and create the EJB we need takes two minutes to do the lookup, which succeeds and get the home and then tries to call create().

Create() hangs for 30 minutes before the ConnectionException error occurs:
INFO | jvm 1 | 2004/09/07 18:51:57 | java.net.ConnectException: Connection timed out
INFO | jvm 1 | 2004/09/07 18:51:57 | lookup() Failed
INFO | jvm 1 | 2004/09/07 18:51:57 | java.rmi.ConnectException: Connection refused to host: xx.xxx.xxx.xx; nested exception is:
INFO | jvm 1 | 2004/09/07 18:51:57 | java.net.ConnectException: Connection timed out
INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:567)
INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:185)
INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:171)
INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:101)
INFO | jvm 1 | 2004/09/07 18:51:57 | at org.jboss.invocation.jrmp.server.JRMPInvoker_Stub.invoke(Unknown Source)

We’ve tried tinkering with many things but to no avail. I tried messing with the windows/sys32/drivers/hosts file without success, though maybe incorrectly.

Also, in another setup elsewhere, the tomcat and jboss don’t have a router involved and work fine.
Any thoughts or ideas?