users@glassfish.java.net

Re: JMS behind firewall does not work :/

From: Ramesh <Ramesh.Parthasarathy_at_Sun.COM>
Date: Wed, 10 Oct 2007 08:51:57 +0530

7676 is the Broker *main* port -- i.e. it's what the port mapper binds
to. The real port, if dynamically bound, is bound to at runtime and tcp
clients connect to 7676 to figure out which real port to bind to for
either normal jms, secure jms, normal admin, or secure admin, which are
all services running on different ports.

To solve the issue, you need to
-- run the jms service on a static port, and open up 7676 + the static
port in the firewall

The MQ docs deal with this --

See 'imq.serviceName.protocolType.port' in

http://docs.sun.com/app/docs/doc/819-4467/6n6k98bqr?a=view

(It's 3.7 docs, but the props are the same)

Piero Filippin wrote:
> Anyone?
>
> Piero Filippin wrote:
>> Any progress with this one? The same is happening to me, GF v58g.
>>
>> When I start lookup for the jms ConnectionFactory or Topic from a
>> standalone client I get in the console:
>>
>> com.sun.messaging.jms.ra.ResourceAdapter start
>> INFO: MQJMSRA_RA1101: SJSMQ JMS Resource Adapter starting...
>> com.sun.messaging.jmq.jmsclient.ExceptionHandler throwConnectionException
>> WARNING: [C4003]: Error occurred on connection creation [XXX:_7676_].
>> - cause: java.net.ConnectException: Connection timed out: connect
>>
>> This is obviously right, port 7676 is closed by the firewall. If I
>> open it to allow JMS, I get:
>>
>> com.sun.messaging.jms.ra.ResourceAdapter start
>> INFO: MQJMSRA_RA1101: SJSMQ JMS Resource Adapter starting...
>> com.sun.messaging.jmq.jmsclient.ExceptionHandler throwConnectionException
>> WARNING: [C4003]: Error occurred on connection creation
>> [XXX:_46328_]. - cause: java.net.ConnectException: Connection timed
>> out: connect
>>
>> I can see that a connection is first made to 7676, and after that to
>> a random port (that keeps changing with every GF restart - it looks
>> like the connection to 7676 is done to negotiate the random port).
>>
>> >From netstat, I can see:
>> tcp 0 0 :::46464
>> :::* LISTEN 20437/java
>> tcp 0 0 :::48201
>> :::* LISTEN 20437/java
>> tcp 0 0 ::ffff:xxx.xxx.xxx.xxx:3820
>> :::* LISTEN 20437/java
>> tcp 0 0 :::8686
>> :::* LISTEN 20437/java
>> tcp 0 0 ::ffff:xxx.xxx.xxx.xxx:3920
>> :::* LISTEN 20437/java
>> tcp 0 0 :::4848
>> :::* LISTEN 20437/java
>> tcp 0 0 :::8080
>> :::* LISTEN 20437/java
>> tcp 0 0 :::37523
>> :::* LISTEN 20437/java
>> tcp 0 0 ::ffff:127.0.0.1:46355
>> :::* LISTEN 20437/java
>> tcp 0 0 ::ffff:xxx.xxx.xxx.xxx:3700
>> :::* LISTEN 20437/java
>> tcp 0 0 :::8181
>> :::* LISTEN 20437/java
>> _tcp 0 0 :::46328
>> :::* LISTEN 20437/java_
>> tcp 0 0 :::7676
>> :::* LISTEN 20437/java
>>
>> This prevents the application being used in my organization, as only
>> a small subset of development machines are inside the firewall, while
>> normal client are outside - if the port is fixed I can open it on the fw.
>>
>> (Also, note there are other "random upper" ports GF is listening to,
>> I am pretty sure JMS is not the only component with this behavior).
>>
>> Piero Filippin
>>
>> Sivakumar Thyagarajan wrote:
>>> Just a note to say we [Ramesh and I] are working with Witold
>>> off-line and would update this thread when we find out what happened.
>>>
>>> Thanks
>>> --Siva.
>>>
>>> Sivakumar Thyagarajan wrote:
>>>> Hi
>>>>
>>>> >> Every port numbers in my domain instance are Glassfish's default.
>>>> >> The port # 32778 is different each time the Glassfish is
>>>> restarted!
>>>> >>
>>>> >> Can someone, please, explain me what is happening?
>>>>
>>>> Is the ACC trying to connect to a JMS configuration in a GlassFish
>>>> Cluster? Could you share your domain.xml configuration with us?
>>>>
>>>> Thanks
>>>> --Siva.
>>>>
>>>>
>>>> Witold Szczerba wrote:
>>>>> Can anyone, please, refer to that JMS+fiewall problem?
>>>>>
>>>>>
>>>>> 2007/8/23, Witold Szczerba <pljosh.mail_at_gmail.com>:
>>>>>> Hi there,
>>>>>> I have a dramatic situation here. Application I write, is running on
>>>>>> Glassfish v2b45 with clients running inside Application Client
>>>>>> Container (ACC) - a Swing application.
>>>>>> Few days ago, in my company, we added JMS, so users can send text
>>>>>> messages to each other using TopicConnectionFactory and Topic.
>>>>>> Everything was OK when we were testing application in our
>>>>>> company, but
>>>>>> today we had to show new version to our customer.
>>>>>> He connected as usual, but now he cannot launch application.
>>>>>> This is very strange, it seems that our application does not work
>>>>>> for
>>>>>> computers behind a firewall anymore.
>>>>>> Here is what happens on a remote computers, when ACC tries to start:
>>>>>> -----------------------
>>>>>> Java Web Start 1.6.0
>>>>>> Using JRE version 1.6.0 Java HotSpot(TM) Server VM
>>>>>> User home directory = /home/sop
>>>>>> ----------------------------------------------------
>>>>>> /// CUT ///
>>>>>> ----------------------------------------------------
>>>>>> Aug 23, 2007 3:39:14 PM
>>>>>> com.sun.enterprise.appclient.MainWithModuleSupport prepareSecurity
>>>>>> INFO: Security Manager is ON.
>>>>>> Aug 23, 2007 3:39:14 PM
>>>>>> com.sun.enterprise.appclient.MainWithModuleSupport
>>>>>> setTargetServerProperties
>>>>>> INFO: ACC001:Using ClientContainer file: [/tmp/sunacc9877.xml].
>>>>>> Aug 23, 2007 3:39:14 PM
>>>>>> com.sun.enterprise.appclient.MainWithModuleSupport setupIIOP
>>>>>> INFO: ACC014: ORB host name: [biuro.ibpolsoft.pl]
>>>>>> Aug 23, 2007 3:39:14 PM
>>>>>> com.sun.enterprise.appclient.MainWithModuleSupport setupIIOP
>>>>>> INFO: ACC013: ORB port number: [3700]
>>>>>> Aug 23, 2007 3:39:21 PM com.sun.messaging.jms.ra.ResourceAdapter
>>>>>> start
>>>>>> INFO: MQJMSRA_RA1101: SJSMQ JMS Resource Adapter starting...
>>>>>> ================================================================================
>>>>>>
>>>>>> Sun Java(tm) System Message Queue 4.1
>>>>>> Sun Microsystems, Inc.
>>>>>> Version: 4.1 (Build 29-i)
>>>>>> Compile: Fri Apr 20 18:24:10 PDT 2007
>>>>>>
>>>>>> Copyright (c) 2007 Sun Microsystems, Inc. All rights reserved.
>>>>>> SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.
>>>>>>
>>>>>> This product includes code licensed from RSA Data Security.
>>>>>> ================================================================================
>>>>>>
>>>>>>
>>>>>> Aug 23, 2007 3:39:22 PM
>>>>>> com.sun.messaging.jmq.jmsclient.ExceptionHandler
>>>>>> throwConnectionException
>>>>>> WARNING: [C4003]: Error occurred on connection creation
>>>>>> [xx.xx.xx.xx:32778]. - cause: java.net.ConnectException: Connection
>>>>>> refused
>>>>>> Aug 23, 2007 3:39:27 PM
>>>>>> com.sun.messaging.jmq.jmsclient.ExceptionHandler
>>>>>> throwConnectionException
>>>>>> WARNING: [C4003]: Error occurred on connection creation
>>>>>> [xx.xx.xx.xx:32778]. - cause: java.net.ConnectException: Connection
>>>>>> refused
>>>>>>
>>>>>> ...and it keeps writing those "WARNING: [C4003]: .........."
>>>>>> --------------------------------------
>>>>>>
>>>>>> Every port numbers in my domain instance are Glassfish's default.
>>>>>> The port # 32778 is different each time the Glassfish is restarted!
>>>>>>
>>>>>> Can someone, please, explain me what is happening?
>>>>>>
>>>>>> p.s.
>>>>>> I have just opened that randomly requested port on my firewall
>>>>>> and now
>>>>>> application works, but it will stop after restarting server. Maybe
>>>>>> some setting is missing in my Glasfish? (as I said, I did not change
>>>>>> any port number, everything is default).
>>>>>>
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
>>>>> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
>>>> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
>>> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>>>
>>>
>>
>