port trigger

[Roberto Nibali]

Hi,

Justin Georgeson wrote:
> I have a server application that is using an anonymous unpriviledged 
> port. (don't ask) So in order to make it work behind a firewall, I 
> currently have to start the server, do a netstat and edit the firewall. 

:) Sounds like one of my first implementations for WAP back in 1998. Is 
it TCP? I kind of assume it actually.

> If I can't figure it out from netstat, I have to run a packet sniffer 
> outside the firewall to see what ports the client is trying to connect 

Wouldn't it be easier to fix it?

> to. I believe the developers of the server are fixing it to use a fixed 
> port, but they asked if my firewall supports port triggering. Port

Ah, ok.

> triggering is when use of one port triggers redirection of another port. 

So that application needs a whole port range. Sounds like lousy backup 
software :).

> I'm not sure how this would work, in this particular case, as the 
> client connects on a well known port and, I believe, is told the 
> anonymous port. I'm not so muched concerned for this particular server, 

Ok, kinda like ftp. So you would need to load balance this well known 
port and since you get the reply with the crucial information of the 
port you need stickyness/persistency. Now, LVS cannot start load 
balancing on newly negotiated ports unless you write the help module for 
it, something like ip_vs_ftp.c.

Another possibility would be to use the port 0 service with persistency. 
There it would work I guess, but I haven't tested it actually. From the 
man page:


        -t, --tcp-service service-address
               Use TCP service. The service-address is of the form
               host[:port].  Host may be one of a plain IP address
               or a hostname. Port may be either a plain port num­
               ber or the service name of port. The  Port  may  be
               omitted,  in  which  case zero will be used. A Port
               of zero is only valid if the service is  persistent
               as  the -p|--persistent option, in which case it is
               a wild-card  port,  that  is  connections  will  be
               accepted to any port.


Yes, so I would assume that it will work.

> since they're fixing it to use fixed ports (as a server should), but 
> it's something that may come up in the future. What I am curious about 
> is if a server behind an LVS NAT sends traffic on port x, can LVS 
> dynamically see that and start forwarding ports y-z, which may include 
> x, back to the original server.

LVS would not see that. But the client would try to connect to this new 
port and this would mean that then the load balancer would recognize a 
new port but the old client template and forward it to the same server 
that sent the dynamic port information.

I say yes, it works but wait until others add their comment too. I might 
just be too tired right now.

HTH and regards,
Roberto Nibali, ratz
-- 
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc