Re: sqlnet and firewall

Hmmm, deja-vu:

What is probably happening is that the firewall changes the ip addresses inside and outside the LAN. Ie, if you have say 203.10.10.10 as the target in your tnsnames.ora at the client and this is a node that the firewall translates to 10.58.22.22 inside the firewall, then you're out of luck. The listener inside will reply with its address embedded in the IP packet instead of in its header and the client will try to continue the conversation with 10.58.22.22, which then gets rejected by the firewall.

tnsping works because it ignores the IP address inside the packet and looks only at the header addresses.

Been there, had the same problem. I'm told that some firewall software can actually inspect inside the packets to change IP addresses put in by brain-dead listeners, but I won't vouch for their performance when doing so....

Sounds to me like you're both outaluck.

--
Cheers
Nuno Souto
nsouto_at_acay.com.au
http://www.acay.com.au/~nsouto/welcome.htm Mark A. Hepler wrote in message <36CB9E12.5F935D6E_at_mediaone.net>...
>Jim,
>I've been experiencing the exact same symptoms as you have described. tnsping
>works, but when I try to connect via SQLPlus or ODBC I get an ORA-12203:
>TNS:unable to connect to destination. C. Day's reply to your message seems
>accurate. The server seems to be attempting to open another connection back to
>the client on another port. But I have not figured out how to restrict it to a
>single port that I can configure through the firewall. I'll let you know if I
>have any luck figuring this out. Would appriciate if you would do the same.
>Thanks, and good luck.
>
>Mark Hepler
>
>
>Jim Kennedy wrote:
>
>> Anyone know how to access SQL net through a firewall?
>> Scenario:
>> Oracle on NT inside with an address say 10.10.10.2
>> and a fire wall makes that address appear as 200.200.200.5 to the outside
>> world. tnsping80 works fine, but not a connection.
>> It looks like the reply on a connection redirects to another port and sends
>> the address back (and the firewall does not catch the 10.10.10.2 and
>> translate it to 200.200.200.5)
>> Ip addresses have been changed to protect the innocent.
>> Jim
>
>
>
Received on Fri Feb 19 1999 - 07:36:44 CST