JConsole and firewalls (I gave up) [Archive]

View Full Version : JConsole and firewalls (I gave up)

kjkoster

21-08-2008, 08:28

Dear All,

Ok, so I thought JConsole was pretty useful. Well, I just spend the better part of a sleepless night trying to get JConsole to work through a firewall. That's crazy work, and I don't even have NAT involved. For some reason it's hugely complex to make JMX available through a single port.

In the end I just opened the firewall between my dev box and the test server. I have better things to do with my time than fight RMI.

Anyway, here is a very useful graphic I ran into on my Google quest. It actually makes JMX Service URL's readable (http://edong.net/2008v1/docs/jmx/jmx-proxy.png).

Kees Jan

Barry

23-08-2008, 14:50

Yes, doing that is probably the best way.
RMI uses two connections, one for setting up the registery and one that is bound at runtime to connect to.
The first connection communicates the URL to the client.
Also note, if you set up the local hostname incorrect, you will be in a world of pain

kjkoster

24-08-2008, 21:27

Dear Barry,

<nit pick>The problem is not so much that RMI uses two ports, but that it uses dynamically assigned ports for the services.</nit pick>

On the FreeBSD Java mailing list others suggested to use ssh tunneling to your local X server and VNC. I have some experience with ssh tunneling jconsole and that was not good. Performance is so bad, on anything but a lightly loaded LAN, that it's unusable. VNC may be better, I should try that out one day.

Kees Jan

holeinone

01-09-2008, 21:57

Just a quick heads-up,

VNC was hacked not so long ago. be sure to use the latest version!

holeinone

01-09-2008, 22:01

You probably thought of this.... But couldn't you use an alternate IP?
1) create a (virtual) IP on your client box
2) use SSH to tunnel a whole range of ports from that virtual IP to the server box.

Just my 2 cents ...

Barry

05-09-2008, 18:20