Security

Ask something
Discussion Locked

Running a server behind a firewall

0 helpful
13 replies

by denis 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I need to run a server behind a firewall, and have clients connect via UDP on port 3800. The firewall is using port address translation (all machines inside get a fake IP), and port 3800 has been opened up. But it still doesn't work (the server does not receive the datagrams). Is there a way to make this work?

13 replies

by darra

The answer to this question actually depends heavily on the type of firewall you have. In many instances, opening the port can actually default to TCP rather than UDP. On other firewalls you have to define a policy in addition to opening the port. With a bit more info I think I can give you a definitive answer.

by mwb

I'm not familiar with PIX but the concept that seems to be missing in the description is redirection. Just opening a port to the inside doesn't do much unless traffic is redirected somewhere specific.

by cuziyq

Without knowing exactly how this is all set up, I would say that you could just add an MX record to the server in your DNS lookup. Whatever traffic comes through on that port still has to be looked up in DNS, right?

by shmaltz

From what you describe i understand that the firewall is a NAT also if so you will have to map that port to the internal IP address of the server for incoming traffic.

by denis

I understand that the firewall has to map UDP packets to 3800 to the specific machine behind the firewall.

(1) how do you do this?

(2) is there any way the server can find out the IP of the firewall? (since it has a fake IP and it needs to register itself in an online server list)

by luis

If you are running the Cisco Pix Firewall, then you must use the Counduit command to permit the access you require. An example of this would be:

conduit permit udp host x.x.x.x eq 3800 any

where x.x.x.x is the private IP address of your internal server.

You should also have a static mapping that translates the private address of your server to a public one. For example:

static (inside, outside) y.y.y.y x.x.x.x netmask 255.255.255.255

where y.y.y.y is the public address and
x.x.x.x is the private address.

This discussion is closed to new replies.