Protege Client Server RMI - Revision history

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T22:07:08Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T22:04:39Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T21:31:44Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond at 20:29, August 6, 2009

2009-08-06T20:29:16Z

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T20:19:53Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T20:14:28Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond: /* Black Magic Trick #1: Tunneling RMI out of a private network */

2009-08-06T20:09:47Z

‎Black Magic Trick #1: Tunneling RMI out of a private network

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T20:09:24Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T20:08:44Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

Tredmond: /* Black Magic Trick #2: Exporting RMI from a NAT'd server */

2009-08-06T19:49:21Z

‎Black Magic Trick #2: Exporting RMI from a NAT'd server

@@ Line 63: / Line 63: @@
 If you are not sure that your machine is living inside a NAT'd LAN then you probably should not be trying these instructions out.  However  an easy  way to determine that you are on a NAT'd LAN is to go to [http://www.dslreports.com/whois this site] and see if the returned ip address is the same as your ip address.  If they are different then you are probably working in the NAT case.
-In this case you are the adminstrator of a private network which has a server that you want to expose.  Unfortunately the private network is protected by NAT so that the server host inside the network is not visible outside the private network. But you can still win!
+In this case you must be the adminstrator of a private network which has a server that you want to expose.  Unfortunately the private network is protected by NAT so that the server host inside the network is not visible outside the private network. But you can still win!
 This technique is more likely to be useful than the previous trick but it requires a bit more care.  When changing the settings on a router you run the risk of breaking the router functionality and causing the network to fail.  Of course, if you know how to set the router up, at a last resort you can always reset the router and reconfigure it.   When I first started playing with settings on my router I came to a phase where I grew over-confident.  I would tunnel to my network remotely and access the router settings.  Once the router was misconfigured, I couldn't access it remotely - I had to wait until I was on-site.  It only took a couple of misconfigurations for me to realize that I needed to be a bit more careful.

@@ Line 59: / Line 59: @@
 = Black Magic Trick #2: Exporting RMI from a NAT'd server =
-'''Please note:''' ''The approach documented here is an advanced technique.  A preferred mode for any server is that it have a dedicated public ip address.   My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results.  Anybody implementing this should have read the description of how rmi works (above) and should have a expert understanding of networks including an understanding of the NAT protocol.  In addition, it will take extra effort (involving configuring a DNS server) to get this approach to work equally inside and outside the LAN.  Configuring DNS servers is outside the scope of what the Protege team will support.''
+'''Please note:''' ''The approach documented here is an advanced technique.  A preferred mode for any server is that it have a dedicated public ip address.   My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results.  Anybody implementing this should have read the description of how rmi works (above) and should have a expert understanding of networks including an understanding of the [http://www.howstuffworks.com/nat.htm NAT protocol].  In addition, it will take extra effort (involving configuring a DNS server) to get this approach to work equally inside and outside the LAN.  Configuring DNS servers is outside the scope of what the Protege team will support.''
 If you are not sure that your machine is living inside a NAT'd LAN then you probably should not be trying these instructions out.  However  an easy  way to determine that you are on a NAT'd LAN is to go to [http://www.dslreports.com/whois this site] and see if the returned ip address is the same as your ip address.  If they are different then you are probably working in the NAT case.

@@ Line 76: / Line 76: @@
 The collab1 and collab2 entries are the ones that I needed.  I was a little surprised to see the vnc line but at least it was not enabled.  Hmm... More bluntly put, I am telling anybody who is new to this to be careful.  If you ever set up a web server on the internet and watch your logs you will see exactly how quickly infected machines find an open port.
 However as before, the problem is that the object that the server registers with the server says it can be found on the host 192.168.2.62.  This address makes no sense to the client and the protocol fails.
@@ Line 88: / Line 84: @@
 </pre>
 Now the server object registered with the rmiregistry will say it can be found at 24.4.236.98.  Note that this will break access to the server inside the private network.  But outside the private network, when the client tries to access this it goes to the router who redirects the request to the server.

@@ Line 23: / Line 23: @@
     -Dprotege.rmi.server.port=5200 -Dprotege.rmi.registry.port=5300
 </pre>
 = Black Magic Trick #1: Tunneling RMI out of a private network =

@@ Line 54: / Line 54: @@
 = Black Magic Trick #2: Exporting RMI from a NAT'd server =
-'''Please note:''' ''The approach documented here is an advanced technique.  A preferred mode for any server is that it have a dedicated public ip address.   My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results.  Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks including the NAT protocol.  In addition, it will take extra effort (involving configuring a DNS server) to get this approach to work equally inside and outside the LAN.  Configuring DNS servers is outside the scope of what the Protege team will support.''
+'''Please note:''' ''The approach documented here is an advanced technique.  A preferred mode for any server is that it have a dedicated public ip address.   My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results.  Anybody implementing this should have read the description of how rmi works (above) and should have a expert understanding of networks including an understanding of the NAT protocol.  In addition, it will take extra effort (involving configuring a DNS server) to get this approach to work equally inside and outside the LAN.  Configuring DNS servers is outside the scope of what the Protege team will support.''
 If you are not sure that your machine is living inside a NAT'd LAN then you probably should not be trying these instructions out.  However  an easy  way to determine that you are on a NAT'd LAN is to go to [http://www.dslreports.com/whois this site] and see if the returned ip address is the same as your ip address.  If they are different then you are probably working in the NAT case.

← Older revision		Revision as of 20:14, August 6, 2009
Line 55:		Line 55:

	'''Please note:''' ''The approach documented here is an advanced technique. A preferred mode for any server is that it have a dedicated public ip address. My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results. Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks including the NAT protocol. In addition, it will take extra effort (involving configuring a DNS server) to get this approach to work equally inside and outside the LAN. Configuring DNS servers is outside the scope of what the Protege team will support.''		'''Please note:''' ''The approach documented here is an advanced technique. A preferred mode for any server is that it have a dedicated public ip address. My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results. Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks including the NAT protocol. In addition, it will take extra effort (involving configuring a DNS server) to get this approach to work equally inside and outside the LAN. Configuring DNS servers is outside the scope of what the Protege team will support.''
		+
		+	If you are not sure that your machine is living inside a NAT'd LAN then you probably should not be trying these instructions out. However an easy way to determine that you are on a NAT'd LAN is to go to [http://www.dslreports.com/whois this site] and see if the returned ip address is the same as your ip address. If they are different then you are probably working in the NAT case.

	In this case you are the adminstrator of a private network which has a server that you want to expose. Unfortunately the private network is protected by NAT so that the server host inside the network is not visible outside the private network. But you can still win!		In this case you are the adminstrator of a private network which has a server that you want to expose. Unfortunately the private network is protected by NAT so that the server host inside the network is not visible outside the private network. But you can still win!

@@ Line 26: / Line 26: @@
 = Black Magic Trick #1: Tunneling RMI out of a private network =
-''The approach documented here is an advanced technique.  My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results.  Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks including ssh and tunneling.''
+'''Please note:''' ''The approach documented here is an advanced technique.  My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results.  Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks including ssh and tunneling.''
 Note that this example is not as well motivated as the next one but it is a little less dangerous.  If you do this technique then you should make sure that you understand the security implications.  Also I only currently know how to set this up on unix machines (including osx).  I am sure that this works on Windows but there is one step where I don't know  the magic incantation.

← Older revision		Revision as of 19:49, August 6, 2009
Line 53:		Line 53:

	= Black Magic Trick #2: Exporting RMI from a NAT'd server =		= Black Magic Trick #2: Exporting RMI from a NAT'd server =
−

	''The approach documented here is an advanced technique. A preferred mode for any server is that it have a dedicated public ip address. My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results. Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks the NAT protocol.''		''The approach documented here is an advanced technique. A preferred mode for any server is that it have a dedicated public ip address. My primary purpose in documenting this was to illustrate an understanding of how the rmi protocol works though this technique can be used to get practical results. Anybody implementing this should have read the description of how rmi works (above) and should have a good understanding of networks the NAT protocol.''