How does FireWall-1 support RPC?

[BarryStiefel]

How does FireWall-1 support RPC?



The following applies to Unix-type RPC services.

Background Information Each RPC-based service has a unique program number (within each service, a version number). When an RPC-based program starts, it will use a random TCP and/or UDP port number. The portmapper is used to map each program number to a particular port used by the RPC-based program at that moment. The connection to the portmapper process must be UDP for FireWall-1 to support it.

How FireWall-1 handles RPC

FireWall-1 supports RPC by monitoring the client RPC request to the portmapper. Then the portmapper replies with the port number. FireWall-1 temporarily opens up that port number for the connection from the client to the server. Once the connection is over, FireWall-1 will close up the port.

Note that if your application requires RPC over TCP (i.e. the connection between client and server is TCP-based), there are two possible solutions:

3.0 firewalls: Modify $FWDIR/lib/fwui_head.def on the management console so that it contains the line: #define RPC_OVER_TCP

4.0 and later firewalls, modify $FWDIR/conf/objects.C on the management console so the property enable_tcprpc is true. For more on editing objects.C, see How do I edit objects.C or objects_5_0.C?

In term of custom application, 99% of the time, you can simply define your custom application as a new service using the following parameters:

• type of connection: TCP, UDP, RPC ...
• port number (for TPC, UDP)
• or program number for RPC

Once you have done that you can use the newly-define service as any other network services: For example, using the following rule

Source Destination Service Action rpc_client rpp_server my_rpc_service Accept

to allow connection from rpc_client to rpc_service using my_rpc_service.

If you cannot define your custom application using the above parameters, you will have to write custom code to handle your custom application, for these situation please contact your support provider for help.

-- GuyR - 18 Jan 2004

FAQForm FAQs.Class: ServicesFAQs FAQs.OS: FAQs.Version: