Port forwarding (specific ports?)

[herbi1313]

I have setup a private Jamulus server for our mixed chorus and it works very fine. Thanks to you all! This is a great application!

Because the server (Windows, running on port 22124) is located behind a firewall I have to forward the "participants" including the UDP ports to the server. I read, that the portrange 22122 to 22125 should be unblocked. My experience is, that most of my "participants" come thru 22175, but one thru 23491 and others thru ... That means for me to unblock all ports to make sure everyone gets access. But this is not good, because to much "open".
My question: Is it possible to have control, thru which port the clients come in?
If you need more information pls. tell me.
Thank you
Herbert

[hoffie]

Hi,

thanks for the feedback! :)

Is it possible to have control, thru which port the clients come in?

Haven't re-checked the code, but as far as I remember, Jamulus already tries to be deterministic about its source ports (which is rather uncommon, as source ports are often chosen completely dynamically).

I assume that what you are seeing may be caused by some (most?) of your clients being behind NAT. Some NAT implementations may rewrite all source ports, some may only rewrite on conflicts (I don't know the actual details).

So, the answer if you can influence this even more, would be No in practice, I suspect.

I'm wondering about the Firewall thing though. It's common to run a firewall in servers, but it's uncommon (at least for me) to filter on source ports. What's the reason for doing that in your case? Wouldn't it be ok to allow many (or all) source ports?

[herbi1313]

Thank you very much for your reply.
Fyi, the Jamulus server is located behind a hardware firewall called IPfire. Here it is possible to specify e.g. protocol (udp, ...) and source ports. That prevents from "too open" doors.

[hoffie]

IMO, limiting the target port is very important (and can be limited to 22124 when running a single Jamulus instance on the default port). In addition, you could set up source address (IP) restrictions (if IPfire supports that). Limiting source ports which can be chosen arbitrarily does not add any security, as far as I can tell.

[herbi1313]

Yes I have limited the target port. Setup source address is also possible within IPFire but mostly change day by day. And you are right, trying to setup radomized source ports (with no influence having) makes no sense.
Thank you again for your support.

[gene96817]

How many computers (that are behind your firewall) need to receive a connection started from the public network?If it is more than one computer receiving inbound connections, you will have to plan the port assignments. If it is only one computer, then you can put that computer (server) in the DMZ (so that will inbound connections initiated from the public network will be received by your computer/server. If you can use. the DMZ, you will not have to plan any port assignments.