Port Forwarding/Open Ports

[Heindrick Yu_1]

Hello and Season's Greetings!

I have a B2000 behind a Netgear firewall/router running HP-UX 10.20. I'm trying to connect to this machine from the Internet. I've configured my router for port forwarding and double checked all my rules.

I can't connect to the machine. It errors with a Winsock Error 10005 (connection reset by peer). However, I can telnet into the machine (allowed through the firewall rules).

Internally (192.168.0.x), I can connect to the B2000 using that program without a problem.

I verified that the ports I'm trying to attach to are opened in the etc/services file.

I'm convinced that the problem lies somewhere in HP-UX because I've moved the machine to the DMZ and the problem still presents itself.

I'm not using DHCP for addressing (I've plugged in a static IP address).

Looking at the syslog, I get the following:

[date][time][proc.name] SYSTD [2223]: Connection from [external address][username]

[date][time][proc.name] SYSTD [2223]: Readline: Connection reset by peer:[external address

Any help/insight would be greatly appreciated.


Warm regards,

Heindrick

[Ron Kinner]

If I understand you correctly you can telnet into the HPUX from the outside but can't use your application to connect to the service. What happens when you telnet into the HPUX on the port that your service uses?


telnet externaladdressofrouter x

where x is the port number your service is listening on? I assume
netstat -an | grep x

shows that the HPUX is listening?

I hope your application isn't something like FTP which requires a second separate connection in order to work.

Does your application need to know who is calling? Could it be that the DNS doesn't work or that you need to put an entry in the hosts file?

You may need to get ethereal and compare the packets when it works to those when it doesn't work.

http://www.ethereal.com/download.html

Ron

[Heindrick Yu_1]

Hi Ron!

Thank you for taking the time to read my inquiry.

I tried to telnet into the machine via the port and I'm getting a connection timed out.

I haven't got to run the netstat -an |grep [portnumber] yet and I'll check if the machine is listening on those ports. I think it is because I can connect from the internal network.

With this application, it uses 2 ports. 1 to connect and the other is like an SSL/secure authentication.

My hosts file only contains the loopback address and the machine name entry.

Warm regards,

Heindrick

[Ron Kinner]

Some of the secure apps do not work with NAT because they put their IP addresses down inside the data packet. However, the fact that a telnet to the port times out seems to indicate that it still being blocked by the router or is not reaching the router. Make sure you have the correct external address. If you browse to:

http://www.inter-corporate.com/ip/

from a machine on the inside of the router it will tell you the external address used by the router. Tho if I understood you correctly you can telnet to the router from the outside. You might try the same telnet test from the inside to see what happens. Maybe there is something happening like a secret handshake that telnet doesn't do.

I would use netstat -an when a local connection is working to make sure you understand exactly what is happening when a connection is made. From what I know of the router's DMZ function it shouldn't matter which port it using which is why I am suspecting that it's a NAT issue.

Is this a commercial app? If it's not classified "burn before reading" it might help to know what it is.

Ron

[Heindrick Yu_1]

Hello Ron!

Allow me to give you the history of the B2000: It may shed some light on this issue.

The B2000 was cloned from another B2000 (exactly the same HW specs) c/o make_tape_recovery using IGNITE.

Before IGNITING the new B2000 with the image, we were successful in trying to connect using this application with the old B2000.

I recently commented out the MAC address in the etc/services file since it was hardcoded.

Now, even the old B2000 won't connect :)

It looks like there must be something that has changed in the network configuration.

Many thanks for taking the time to check out my issue.

Warm regards,

Heindrick

[Ron Kinner]

Do

arp -a

on both machines and see if they both have the same MAC.

This can be set in a file something like:

/etc/rc.config.d/hpbtlanconf. It's possible since the MAC was hardcoded in one place it might be hardcoded in another.

Ron

[Heindrick Yu_1]

Hello! Here's an update on this little quest:

I was able to talk to HP's tech support and they led me as far as they could and because of the termination of support for 10.20, I wasn't given much options.

We've patched the network portion of the OS but we still can't get connectivity.

They recommend upgrading to 11.x.

Here's a new development with the case:

1. Since the program on the external workstation requires two ports, we tried using the ports 1 at a time.

Using 1 port allowed us to connect for a brief moment (20124: the splash screen and the desktop of the program loads; eventually fails) then the router kicked us out because it couldn't find an appropriate firewall rule for port 20123.

2. Using port 20123 alone immediately kills the program (winsock error).

So there's something wrong with the port 20123 or the associated process. I've verified my etc/services file and it's opened (add to the fact that my internal network can connect to the b2000 fine).

Any help would be greatly appreciated.

Warm regards,

Heindrick