Re: VPN access to 9ias instance behind firewall

RE: VPN access to 9ias instance behind firewallThe issue is, that when you ssh to your site, it uses probably port 22 or 22022. But when you just go to http://site.com , the browser actually connects to your site port 80, unless there's a proxy specified, then your browser connects to proxy server and hands the http request over to it. Now, could it be that port 22 is open in fiewall for your clients to connect, but port 80 isnt? You gotta ask from your network administrator about it. But a simple way to test it without a browser is just to telnet to your site's port 80. I think by "telnet isn't allowed" you mean that all telnet daemons are shut down in your servers. But that's ok, you actually can telnet to any webserver, just telnet to your sites port 80 and see what happens.

* If you get a connection refused or like error then either some firewall blocks your access to webserver. 
* If your connection just hangs, even when and pressing enter in telnet window, then it's probably firewall again. 
* If your telnet connection seems to hang, but quits when you press enter (or spits out HTML when you type GET / in prompt) then the connection to webserver is available, but the problem is in browser or proxy. 

You can verify the proxy settings somewhere from tools->options->network...blah or smth like that, somebody should know it for sure in your office...

About point 3 - a good starting point would be to nslookup or ping the hostname which you're trying to connect to and see whether the net name is even resolved to ip address?

Tanel.

• Original Message ----- From: Paula_Stankus_at_doh.state.fl.us To: Multiple recipients of list ORACLE-L Sent: Thursday, August 28, 2003 1:34 AM Subject: RE: VPN access to 9ias instance behind firewall

  Dear Tanel,

  Thanks for the reply. I have some questions:     -----Original Message-----
    From: Tanel Poder [mailto:tanel.poder.003_at_mail.ee]     Sent: Wednesday, August 27, 2003 5:49 PM     To: Multiple recipients of list ORACLE-L     Subject: Re: VPN access to 9ias instance behind firewall

    Hi!

    How is the "VPN" set up? Is it just a ssh tunnel or is it a real VPN with routing etc..?
[Stankus, Paula G]

    SSH is allowed through the hosts.allow file in Unix

1. check whether the url your users type in is directed through proxy. And proxy server isn't aware of this VPN. In this case disable the proxy or make it aware of vpn
   [Stankus, Paula G] How would I know this.
   
2. if no proxy is used, then ask your users just to telnet to the url (for http://site.com they have to telnet site.com 80, and see if they get an error. If not (the telnet seems hanging, type GET / in it and see whether any html is returned). That way you should at least isolate whether the problem is in browser or not)
   [Stankus, Paula G] Can I have them do a ssh http.site.com <portid> instead? Telnet is not allowed at all.
   
3. if you are dealing with local ssh tunnels, then you probably have to change your c:\winnt\system32\drivers\etc\hosts accordingly (if using windows), to set that the site.com where you want to connect, actually points to your own machine (127.0.0.1) and ssh directs your connections to the right point from there. I've used this mechanism for several customers support.
   [Stankus, Paula G] If client is coming from Texas and we are in Florida whose c:\winnt\system32\drivers\etc\hosts file needs to be setup (9ias is running under Unix) - we have localhost setup in our Unix host file. Can you explain #3 in more detail or point me to a document?
   

    Thanks,
    Paula

    Tanel.

• Original Message ----- From: Paula_Stankus_at_doh.state.fl.us To: Multiple recipients of list ORACLE-L Sent: Wednesday, August 27, 2003 11:29 PM Subject: RE: VPN access to 9ias instance behind firewall

      Guys,

      When user trys to run our application through a VPN behind the firewall in a url they get an error. They can use ssh to get to host where I installed the application server but not run the application through their browser. Anyone deal with this issue before?

      Thanks, 
      Paula 

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: Tanel Poder
  INET: tanel.poder.003_at_mail.ee

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).