Re: Understanding NAT, Firewalls, TCP/IP

Roedy Green wrote:

> On Wed, 11 Jan 2006 10:56:18 +0100, Thomas Weidenfeller
> <nobody@xxxxxxxxxxxxxxxx> wrote, quoted or indirectly quoted someone
> who said :
>
>>It is not clear from your
>>description who initiates the connection. If you have some client behind
>>a NAT which initiates a connection it shouldn't be a problem.
> My project is a tool for organising the internationalisation of Java
> code by teams. See http://mindprod.com/projects/internationaliser.html
> for my latest thinking on how this will work.
>
> The client would initiate connections and there is no client to client
> communication. Just traditional client to server.

Provided there is no server-to-client communication other than on the
client-initiated socket, there shouldn't be any problem due to NAT.

>
> Some of the clients will be relatively computer naive people working
> on home computers in remote parts of the globe as language
> translators. They may have a home router firewall, or some software
> firewall, which they will not understand. They will have just plugged
> it in and left it to defaults.

Most home NAT routers don't even have a firewall. Those which do are generally
shipped with the firewall disabled. It's only people who know about them (and
possibly how to set them up) who will use them. It's very unlikely they would
block outgoing connections on ports other than http/ftp.

Personal, software, firewalls are becoming much more common. When the user tried
to connect to your server using your client software they ought to get a
warning of some sort. You'd need to warn your users of this, so they would be
expecting it and not "panic" and block it.

>
> I want wondering if there are firewalls that might by default block
> outgoing tcp/ip connections to anything other than port 80 or FTP
> ports.

If the user is behind a "corporate" firewall there's a good chance that this
will be true. Given that, it's also true that the firewall will [probably] be
administered by someone competent who can be asked for assistance in enabling
connection to your server. It's also true that many network/security admins are
not reasonable people...

Many real firewalls now do deep packet inspection and look at the contents of
the packets, which makes it much more difficult for you to "hijack" the http or
ftp port for your own, custom, protocol.

--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : nmw@xxxxxxxxxxxx
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555
.

Relevant Pages

  • Re: Bug with W2K3, SP1, Windows Firewall and FTP
    ... I have firewall enable and I can connect fine. ... the port 21 connection for some reasons. ... The client then gets the ... the FTP sessions (using the command ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: is sbs2003 setting up my clients firewall, greyed out
    ... You could look there and see if remote access is enabled and if the user ... configures the Windows Firewall appropriately. ... the client could not connect to the remote computer. ... basically log onto the vpn connection. ...
    (microsoft.public.windows.server.sbs)
  • Re: remoting not working through vpn
    ... The problem was that the server could not connect with the client using the ... local ip address rather than the ip address of the vpn connection. ... >>and opened that port on the client's firewall, ...
    (microsoft.public.dotnet.framework.remoting)
  • Re: Host Computer with ICS cannot be accessed
    ... >the printer and My Docs are shared (but unlike the Client who showed that ... I've also suspected firewall issues ... The Host computer is running XP HE w/SP1.... ... >a dial up connection. ...
    (microsoft.public.windowsxp.network_web)
  • Re: VPN Connection Failure
    ... >>>I am having difficulty resolving a VPN connection error. ... >>>When the client is in my local domain, ... >>>This issue only occurs outside the firewall. ... >>>configureation of the firewall by the SBS internet connection wizard. ...
    (microsoft.public.windows.server.sbs)