Subject: [BEEPwg] Firewall Traversal

From: Doug Ransom <[email-masked]>
Date: Wed, 20 Mar 2002 12:33:52 -0800

I am trying to understand how peers might traverse a firewall.  In the
instant message scenario, would a peer need a continous tcp or beep
connection to an outside proxy in order to receive messages from another
peer?

Doug Ransom 
Internet Technologies Domain Lead 
Power Measurement http://www.pwrm.com <http://www.pwrm.com/>  
mailto:[email-masked] <mailto:[email-masked]>  

MSN Messenger [email-masked]

---

From: james woodyatt <[email-masked]>
Date: Wed, 20 Mar 2002 13:23:34 -0800

On Wednesday, March 20, 2002, at 12:33 PM, Doug Ransom wrote:
> connection to an outside proxy in order to receive messages from 
> another peer?

The answer is "yes," "no," or "maybe" --depending on the sort of 
firewall.

If the firewall is not a network-layer filtering firewall, and it 
doesn't transparently route Internet packets, then by its definition: 
you need a proxy for your instant messaging application.

If the firewall is a network-layer filtering firewall, and it *does* 
transparently route Internet packets, then by its definition: you do not 
need a proxy for your instant messaging application.  (You may need to 
apply appropriate policies.)

If the firewall is a network-layer filtering firewall *and* it is 
integrated with a network address translation function, then your 
instant messaging application may need an application layer gateway in 
the firewall, or it may need a rendezvous service residing elsewhere on 
the network.

What sort of firewall are you talking about?

--
j h woodyatt <[email-masked]>

---

From: Eliot Lear <[email-masked]>
Date: Wed, 20 Mar 2002 13:28:59 -0800

I presume you mean a firewall that disallows incoming TCP and all 
UDP.  This sounds like a good MIDCOM application.

Eliot

At 12:33 PM 3/20/2002 -0800, Doug Ransom wrote:
>connection to an outside proxy in order to receive messages from another peer?
>
>
>
>Doug Ransom
>Power Measurement <http://www.pwrm.com/>http://www.pwrm.com
>mailto:[email-masked]
>

_______________________________________________
BEEPwg mailing list
[email-masked]
http://lists.beepcore.org/mailman/listinfo/beepwg

---

From: Daniel Lundin <[email-masked]>
Date: 20 Mar 2002 22:42:16 +0100

Doug Ransom <[email-masked]> writes:

> I am trying to understand how peers might traverse a firewall.  In the instant message
> scenario, would a peer need a continous tcp or beep connection to an outside proxy in order
> to receive messages from another peer?

The TUNNEL profile might be worth a look. It provides application level BEEP
proxying, typically with some form of authorization depending on your
application.

<URL:ftp://ftp.ietf.org/internet-drafts/draft-ietf-idwg-beep-tunnel-02.txt>

-- 
Daniel Lundin  | [email-masked]
CodeFactory AB | http://www.codefactory.se/
_______________________________________________
BEEPwg mailing list
[email-masked]
http://lists.beepcore.org/mailman/listinfo/beepwg

---

From: Gabe Wachob <[email-masked]>
Date: Wed, 20 Mar 2002 18:56:57 -0800 (PST)

The TUNNEL profile is not directly intended for this purpose - as I read
it, its meant for creating a tunnel across a series of hops and doesn't
itself say anything about how to traverse a firewall or anything about
"rendezvous" (proxy) peers.

Thats not to say the TUNNEL profile wouldn't be useful in constructing a
spec to do this, I just didn't see the TUNNEL profile doing this out of
the box...

	-Gabe

-- 
Gabe Wachob                   [email-masked]
Personal                   http://www.wachob.com
CTO, WiredObjects    http://www.wiredobjects.com