Re: RMI app behind NAT firewall

The problem is solved, finally, many thanks. Peter, you were right.
My RemoteObject extends UnicastRemoteObject and instead of calling super()
I explicitly qualify
the port my RemoteObject listens to in favor of an anonymous port.

   public RemoteObject() {
         super(1099);
         ...
   }

Futhermore I bind my remoteObject to the registry on localhost:

    reg.rebind(CommandBroker.NAME, this);

and start the server with

    -Djava.rmi.server.hostname=9.154.38.47 (public IP)

This did the trick and I am perfectly happy now.
Thanks again,
Tobi




Peter Jones - JavaSoft East <[email protected]>
27.01.2006 20:39

To
Tobias Weih/Germany/IBM@IBMDE
cc

Subject
Re: RMI app behind NAT firewall






> I have a problem getting my RMI application to work. Having a RMI Server
> app running in a VMWare that forwards port 1099 in a NAT enviroment.
> Physical machines IP on the outside = 9.154.38.47
> Physical machines IP in local area = 192.168.0.1
> Virtual machines IP = 192.168.0.100
>
> I start a rmiregistry on my virtual machine and since port 1099 is
> NAT-forwarded I can connect to the registry from the outside using
telnet
> 9.154.38.47:1099.
>
> I startup my serverside rmi-app on the virtual machine
> code:
>
> -Djava.rmi.server.hostname=$HOST
>
> and in my app I do the following binding:
> code:
>
> System.getProperties().put("java.rmi.server.hostname", HOST);
> Registry reg = LocateRegistry.createRegistry Registry.REGISTRY_PORT);
> Naming.rebind("//"+ HOST + ":1099/" + CommandBroker.NAME, this);
>
> This work fine with HOST=127.0.0.1 or HOST=192.168.0.100 but when
setting
> HOST=9.154.38.47 (the public IP address), startup fails with:
> code:
>
> java.rmi.AccessException: Registry.Registry.rebind disallowed; origin
> /9.154.38.47 is non-local host

I guess that this failure is happening because the connection to
9.154.38.47 is being routed out to the NAT and back in again, so its
origin appears non-local.

But the host name or address passed to Naming.rebind is not
consequential to the future behavior of the registry binding
(i.e. whether a given client can use the binding if it can access the
registry)-- it is only used to contact the registry for the rebind
operation.  So it would be fine to pass an internal host address to
Namind.rebind, like 127.0.0.1 or 192.168.0.100, and that shouldn't
cause an AccessException.

Alternatively, because the registry is created in this VM, and you
have a local reference to it right there, you could just invoke rebind
on it directly, thus avoiding the origin host access control check
altogether:

    Registry reg = LocateRegistry.createRegistry(Registry.REGISTRY_PORT);
    reg.rebind(CommandBroker.NAME, this);
[*]

As far as an external client being able to use the bound stub, the
important setting is the java.rmi.server.hostname system property,
which controls the host name or address that gets put into the stubs
for remote objects exported in this VM.  Also note that you'll
probably need to export your remote object on an explicit TCP port,
like 1099, so that communications to it are appropriately forwarded by
the NAT too; for example, see:

    http://archives.java.sun.com/cgi-bin/wa?A2=ind0302&L=rmi-users&P=3663

-- Peter

[*] For completeness, another alternative is to replace use of the
Naming API with an invocation of LocateRegistry.getRegistry, which
synthesizes a registry stub, followed by Registry invocations on the
registry stub (the Naming methods are just wrappers around those steps
anyway)-- among other benefits, this clarifies that the host value is
only used to contact the registry.


===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff RMI-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

For a list of frequently asked RMI questions please refer to:
http://java.sun.com/j2se/1.3/docs/guide/rmi/faq.html

To view past RMI-USERS postings, please see:
http://archives.java.sun.com/archives/rmi-users.html