Amanda-Users

RE: Which ports to open in which direction...

2005-12-04 03:32:05
Subject: RE: Which ports to open in which direction...
From: "David Leangen" <amanda AT leangen DOT net>
To: "Kevin Till" <kevin.till AT zmanda DOT com>
Date: Sun, 4 Dec 2005 17:05:48 +0900
Hello, Kevin,

> does your current setup work for you? I guess it should work
> most of the time. In your case, it'll fail when it couldn't find an
> open port in tcp 50000:50100 or in udp 700:710.

Actually, I haven't yet had time to see this through all the way. I was
hoping that the docs would be clear about which ports I need to open (and
only which ports), but I find I'm a bit confused...

I was hoping for some clarification, and I thought the wiki page would be
the best instrument to do this so that others may profit.


In any case, I have no problems with my local connections, but I need to
figure out which ports to open for my remote connections.

This is as far as my understanding goes. Think you could clarify the rest of
the process for me?

 IP Traffic

 Waiting state:
      RHost listens on 10080/udp
      FWHost listens on 10080/udp
      LHost listens on 10080/udp
      TSHost listens on 10080/udp

 amdump process begins:
      TSHost sends request to RHost on port 10080/udp (via FWHost)
      TSHost sends request to FWHost on port 10080/udp
      TSHost sends request to LHost on port 10080/udp
      TSHost sends request to localhost on port 10080/udp

 amandad process begins on each client:
      xHost accepts request on 10080/upd
      xHost replies to TSHost on a port in --with-tcpportrange


The above is taken from the wiki page:

  http://wiki.zmanda.com/index.php/Configuration_with_iptables


What happens after each host replies to the tape server host over
{--with-tcpportrange}? Or is that all? There are other ports mentioned in
the docs, but I don't yet see the connection (no pun intended) with all
this.


> Currently, amanda will try the tcpportrange/udpportrange first. If it
> couldn't find an open port in that range, it will try to get ANY open
> port. In this case, it will fail in your firewall setup.

Oh, didn't know that...

Cheers,
Dave