OpenBSD, Packet filter and Apache Tomcat

Discussion in 'Java' started by Archevis, Oct 16, 2003.

  1. Archevis

    Archevis Guest

    I'm trying to set up a standalone Tomcat server behind an OpenBSD
    packet filter. I need to use NAT and redirect to the proper server. By
    default Tomcat runs on port 8080 avoiding the need to run as root on
    protected port 80. So obviously I'd like to redirect incoming requests
    on firewall port 80 to Tomcat server port 8080, but there's no
    response. However, if I run Tomcat (as root) on port 80, and redirect
    properly in pf.conf all works swell. So it would appear as the problem
    oddly enough is related to redirection of... port number?

    The (possibly) relevant extracts from pf.conf:

    scrub in all
    nat on xl0 from rl0 to any -> xl0
    rdr on xl0 inet proto tcp from any to xl0 port 80 -> 192.168.0.10 port
    8080
    block in on xl0 all
    pass in on xl0 inet proto tcp from any to any port 80 flags S/SA keep
    state

    Anyone have any idea why this setup would work with port 80 but not
    8080 in line 3 above?
    Archevis, Oct 16, 2003
    #1
    1. Advertising

  2. Problem solved. Forwarding in case others experience the same... :)


    Daniel Hartmeier wrote:

    > On 16 Oct 2003 00:32:01 -0700, Archevis wrote:
    >
    >> rdr on xl0 inet proto tcp from any to xl0 port 80 -> 192.168.0.10 port
    >> 8080
    >> block in on xl0 all
    >> pass in on xl0 inet proto tcp from any to any port 80 flags S/SA keep
    >> state
    >>
    >> Anyone have any idea why this setup would work with port 80 but not
    >> 8080 in line 3 above?

    >
    > Because the rdr translation occurs before the filtering with
    > block and pass.
    >
    > When you redirect to port 8080, the packets will have destination
    > port 8080 when the pass rule is evaluated. Since you only pass
    > destination port 80, the translated packets don't match and they
    > are blocked. Translation does not imply passing. Pass port 8080,
    > and it will work.
    >
    > Daniel
    John M. Nordgaard, Oct 16, 2003
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Christos Gravvanis
    Replies:
    0
    Views:
    2,034
    Christos Gravvanis
    Jul 7, 2004
  2. twins
    Replies:
    1
    Views:
    5,835
  3. Geoff

    OpenBSD, Apache and Python

    Geoff, Jan 7, 2007, in forum: Python
    Replies:
    1
    Views:
    474
    =?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=
    Jan 7, 2007
  4. Li Han
    Replies:
    2
    Views:
    500
    bobicanprogram
    Feb 9, 2009
  5. Gelonida N
    Replies:
    4
    Views:
    866
    Gelonida N
    Sep 11, 2011
Loading...

Share This Page