I have to set up a Virtual Machine on vBox that works as a server for my app. Now, the app sends data to http://x.y.w.z:4567. I run apache server on host and wireshark confirms that the packet is received. Guest is behind NAT and is set up to forward TCPs from any IP port 4567 to port 443 on guest. I tried various versions of setting and not setting IP. Guest also has apache running, but it receives no packets. What should I do?
Please check the log that your port-forward rule is active. Also that your guest/host firewalls doesn't drop packets.
Related
Through tcpdump in dhcp-server, it shows the server can receive the DHCPDISCOVER package and send the DHCPOFFER package, but can not receive the DHCPREQUEST package from the dhcp-client, so the client can not get IP address and always in send DHCPDISCOVER package.
But the dhcp-server which runs in VMWARE's instance can send DHCPACK to client and the same client will get the IP success. The dhcp-server using the same configure as in Openstack's instance.
And, if I configure the static IP address in the client instance, it will ping the dhcp-server's IP successful.
One more thing, the server and client are in the same vlan.
Is there any limit rule in Openstack's instance? How can I resolve this problem, THX.
The essential reason is that the traffic of port is limited by the security groups in openstack.
By default, all security groups contain a series of basic (sanity) and anti-spoofing rules that perform the following actions:
Deny egress DHCP and DHCPv6 responses to prevent instances from acting as DHCP(v6) servers.
Resolution:
disable security groups (no recommend)
set dhcp-relay to the dhcp server in router (recommend)
security groups limited the traffic by hypervisor's iptables which will drop the packets which's src port is 67 and dst port is 68.
DHCPOFFER packets will send to router by src and dst port 67, and it will works to all vlans.
For DHCP relay and DHCP proxy, packets sent to the DHCP server from the router have both the source and destination UDP ports set to 67. The DHCP server responds using the same ports.
Maybe there are some methods but I can't find out until now ?
I have a java program that uses SQL queries. The goal is to send them from my home PC to a workstation on a different network elsewhere.
The SQL server is on Windows Server and I opened port 1433 for inbound connections. From that computer, I can successfully ping the port. However, I can't ping the port from the public ip address, only the local (192.168...), so it doesn't work if I were to try to ping it from my home computer.
Is there a way that I can ping it from my home computer? If so, how would I specify the address for JDBC?
Thanks!
It sounds like your Windows Server is behind an internet gateway/router. You need to configure the gateway to allow and forward inbound connections to TCP port 1433 to the IP of the computer that has SQL Server installed.
Here are some guides that explain how to enable port forwarding on different devices:
How to Forward Ports on Your Router (lifewire.com)
How to Port Forward (No-IP.com)
Also, note that we can ping IP addresses, not ports.
I have a Ubuntu Server 16.04 running on a machine in my local network.
The machine has static assigned IP and running apache2. There is no problem in connecting to it from my local network.
I have port-forwarding for ports 22 and 80 setup on my router to the IP address of the machine.
When I check the ports with my public IP address on sites like http://www.canyouseeme.org/ the result is that the ports are open. When I try to connect using my public IP address and using those ports the connections are refused.
I tried disabling firewall in the router and also on the machine, no result.
What else should I try? It seems that the server is getting no incoming connection when I check with netstat.
Just for troubleshooting purposes:
Setup port forwarding on port 22 and try to ssh into your server using the public IP? If it works, it means apache is refusing the connections and not your router or ISP
On your router, setup the server on the DMZ temporarily and check if it works
Add another port forwarding rule on your router to redirect all http requests on port 8000,for example, to port 80 internally, then try to access your server with http://[public_ip]:8000
Have you changed anything on the apache2.conf file? Also, explain how you are testing the connection, internally using the public IP or from the Internet?
I open IE explorer & Chrome in my computer and type localhost:80 and I get the index page.
Here I think my machine's IP is same to both connections (IE explorer & Chrome) and ports are too (80).
Note: Source port will be different (as destination is same: localhost IP), this is my second question.
So how webserver (lets say apache) handles this port 80 connections without failing? Does it port forwarding? In OS level even I tried with addr re-use, port re-use parameters and it is all same we cannot make multiple connection with same IPs & ports.
Now, probably you have came up with a solution: although source ports and IPs are same, destination port is different in package: <protocol>, <src addr>, <src port>, <dest addr>, <dest port>.
A. I got 49483~50004 ports as you can see on image. How client knows which destination port (49483~50004) is bound by webserver? If it is random between 0 and 65355 the webserver always binds all ports, it is very resource consuming. How webservers avoid from this?
Look at this image: command prompt-> netstat
If this question is related with low level sources it is OK, I understand Embedded TCP/IP/UDP, Phy MAC communication and package structures.
You have this all back to front.
All the port numbers at the server are the same: 80. So the client only has to know port 80.
All the port numbers at the client are different: 49483-50004 etc. So there is no ambiguity in the connection, because the 4-tuple you mentioned is unique.
All http request by default call to servers in the port 80, because servers listen by default in that port. So you only give an IP or hostname and the web browser add the default port (80). You can give a custom port if you web server is listenning in another port (usually Tomcat listen by default in 8080) for example you call it in: http://www.youamazingweb.com:8080.
A good example is see the IP as the home and the port is the door where clients enter to consume some resource hosted in server.
I was looking for an answer on my question on google and also here, but a didn't find a proper answer.
So here is the context:
I have a software running on some server (without firewall) in one subnet.
There is another software running on some PC in a different subnet.
Both subnets are connected to a gateway server. All computers are running CentOS or RHEL.
On the gateway server, there is a firewall, preventing multicast traffic from leaving the one subnet and allow clients from outside to connect to computers inside this subnet. Therefore xinetd is used. The computer from outside needs to send a packet to a specific port, the computer on the inside answers to another specific port depending on the sender. So there is no need for the gateway to keep track of sender-receiver relations. It just needs to forward UDP on specific ports to specific computers from one subnet to another.
So I added one service in /etc/services (for one direction):
udp-gateway 6000/udp
And created the according configuration file in /etc/xinetd.d/gateway like:
service udp-gateway
{
disable = no
socket_type = dgram
protocol = udp
wait = no
user = root
redirect = 192.168.1.1 6000 #Server inside the 192.168.1.0 subnet
}
Now the problem is, that the server doesn't open an UDP-port to listen on ('netstat -nulp' says). When I change the protocol to TCP and the socket_type to stream, it works. But I need this for UDP.
Is it possible that this is not possible for UDP? Or is netstat just not showing the ports? Or is my xinetd-configuration missing something?
Thanks in advance, every hint is appreciated.
Benny
redirect = 192.168.1.1 6000 #Server inside the 192.168.1.0 subnet
from the man page of xinetd:
redirect
Allows a tcp service to be redirected to another host.
This means usage of redirect for udp is not possible. And I don't see any other way to do this with xinetd.