4 Replies Latest reply on Sep 8, 2004 3:24 PM by neil upfalow

    Firewall configuration for JBoss

    Mike Stephen Newbie

      Hi guys,

      I am trying to figure out which ports to open up on a
      firewall, to allow a java client to call a method on
      a stateless session bean. I am running JBoss3.0.4, and
      can see through the JMX Console that the bean is deployed
      fine.

      It seems that I need to open up 1099 for JNDI, 4444 for
      RMI, and using port sniffer software I found a mystery
      port that keeps changing each time I restart the server.

      Does anyone know a way of fixing the mystery port to be
      the same port each time, as then I could just open up
      this port on the firewall.

      I know that the java client - session bean works because
      I have run it on 2 machines inside the firewall no
      problems.

      Any ideas?

      Thanks,

      Mike.

        • 1. Re: Firewall configuration for JBoss
          Peter Povse Newbie

          Hi Mike!

          I had the same problem.
          JBoss is using an anonymous RMI-Port. The port number changes everytime you restart JBOSS. (Under UNIX you can see this with netstat -l)
          But you can set the port by inserting a property in the <JBOSS_DIST/server/???/conf/>jboss-service.xml:
          .
          .
          .
          <!-- ==================================================================== -->

          <!-- The invokerServletPath property gives the public URL to the
          org.jboss.invocation.http.servlet.InvokerServlet used by the
          HTTP proxy for RMI/HTTP. This is only needed if the http-invoker.sar
          is deployed.
          -->

          invokerServletPath=http://localhost:8080/invoker/JMXInvokerServlet
          >>>> jnp.rmiPort=34159

          <!-- Load properties from each of the given comma seperated URLs

          .
          .
          .

          Have marked the line with >>>>
          Now JBOSS will listen on port 34159.
          I don't know if this is the right way to do this, but it works fine.

          But know I have got another problem which could be yours too:
          My Jboss-Webserver (with the local IP 192.168.1.3) is behind a firewall/router (with one static IP).
          The firewall accesses the server via NAT (by translate the ports 1099,4444,and the jnp.rmiPort).
          Contacting the jboss-server from other computer in the local net works. But when I try to connect
          the Server from the internet it fails with an error like this:

          javax.naming.CommunicationException [Root exception is java.rmi.ConnectException:
          Connection refused to host: 192.168.1.3; nested exception is:
          java.net.ConnectException: Verbindungsaufbau abgelehnt]

          For me this seem that the initial connection to the server is ok. But then the server answers with
          its own IP (maybe from the /etc/hosts), which is a local IP address.
          With this local IP the client cannot do any further connection!

          If I change the webservers IP to the static IP, the server can be addressed from the internet but
          no longer from the local net. Isn't it funny?!

          Does anybody have an idea ?

          • 2. Re: Firewall configuration for JBoss
            Mike Stephen Newbie

            Hi,

            Thanks very much for your help on fixing the port number!

            The next problem you seem to be having, we had too and
            this is how we fixed it (after searching the forums):

            In your run.sh or run.bat, change the following line:

            JAVA_OPTS="$JAVA_OPTS -Dprogram.name=$PROGNAME"

            to:

            JAVA_OPTS="$JAVA_OPTS -Dprogram.name=$PROGNAME
            -Djava.rmi.server.hostname=aaa.bbb.ccc
            -Djava.rmi.server.useLocalHostname=false"

            where aaa.bbb.ccc is the externally visible domain name
            of the firewall machine that will be doing the forwarding
            to the internal jboss server. You might be able to put
            the IP address of the firewall machine in there instead,
            I'm not sure.

            Thanks again for your help on this, and best of luck.

            Mike.

            • 3. Re: Firewall configuration for JBoss
              Nagaraj Newbie

              Hi,
              I am facing the prolem of this Dynanmic port getting created by the Server.. in JBoss2.4.4 do you have any solution on how to do it in JBoss2.4.4

              • 4. Re: Firewall configuration for JBoss
                neil upfalow Newbie

                We use tomcat hosted elsewhere to talk to our windows xp JBOSS 3.0.4 ejb in our network behind a router.
                I have set the jnp.rmiPort to 34159 in jboss-service.xml so I could open and forward the port to the JBOSS box.
                Also ports 4444, 8070, and 1476 are forwarded to this JBOSS box.
                Also use -Djava.rmi.server.hostname=xx.xxx.xxx.xxx -Djava.rmi.server.useLocalHostname=false
                These settings allowed lookup of the a jboss queue using a test jsp page.

                Another test page that tries to lookup and create the EJB we need takes two minutes to do the lookup, which succeeds and get the home and then tries to call create().

                Create() hangs for 30 minutes before the ConnectionException error occurs:
                INFO | jvm 1 | 2004/09/07 18:51:57 | java.net.ConnectException: Connection timed out
                INFO | jvm 1 | 2004/09/07 18:51:57 | lookup() Failed
                INFO | jvm 1 | 2004/09/07 18:51:57 | java.rmi.ConnectException: Connection refused to host: xx.xxx.xxx.xx; nested exception is:
                INFO | jvm 1 | 2004/09/07 18:51:57 | java.net.ConnectException: Connection timed out
                INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:567)
                INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:185)
                INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:171)
                INFO | jvm 1 | 2004/09/07 18:51:57 | at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:101)
                INFO | jvm 1 | 2004/09/07 18:51:57 | at org.jboss.invocation.jrmp.server.JRMPInvoker_Stub.invoke(Unknown Source)

                We’ve tried tinkering with many things but to no avail. I tried messing with the windows/sys32/drivers/hosts file without success, though maybe incorrectly.

                Also, in another setup elsewhere, the tomcat and jboss don’t have a router involved and work fine.
                Any thoughts or ideas?