Re: Issue connecting through firewall using jdbc connector.

From: SqlJunkies User (User_at_-NOSPAM-SqlJunkies.com)
Date: 09/07/04

  • Next message: Frank Brouwer: "Re: JDBC & Tempdb file growth" 
    Date: Tue, 07 Sep 2004 04:50:50 -0700

    I think I have ran into the same problem. I am developing an application that must reside within DMZ and must have access to a SQL server on the internal network. I think the problem is the MS odbc and jdbc drivers. They try to use NetBIOS over TCP instead of just pure TCP.

    My case is as follows:
    * Web application(ASP) in DMZ
    * MS ODBC driver
    * Firewall between DMZ and internal network(port 1433 open)
    * SQL Server on internal network

    The problem is that the ODBC driver seems to try to connect to the database through SMB, Server Message Block, wich is a windows service for file and printer sharing. SMB relies on the NetBIOS service wich in turn relies on TCP or SPX or whatever it is set up to use. Now, NetBIOS uses udp port 137. This port is not opened in our firewall, as in your case. Therefore the application in the DMZ can not establish a connection with the sql server.

    I think there are two possible solutions for this problem:
    * Find a driver that uses only TCP and not TCP via NetBIOS
    * Disable NetBIOS and SMB in the web server

    The second solution works very godd, I think. Not a solution for us, though, since the web master has set up a Microsoft network within the DMZ. And you have to disable Microsoft network to disable SMB.

    Sorry for my bad english. Hope that what i have written helped a little, at least. 

    ---
Posted using Wimdows.net NntpNews Component - 
Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup engine supports Post Alerts, Ratings, and Searching.
  • Next message: Frank Brouwer: "Re: JDBC & Tempdb file growth"

    Relevant Pages

    • Re: [fw-wiz] Rationale of the great DMZ
      ... >DMZ and its implied security has changed. ... Network activity wouldn't ... >necessarily begin from the DMZ and be tunneled in to the internal network. ... >Commonly SSL accelerators terminate the SSL end point prior to the ...
      (Firewall-Wizards)
    • Re: Firewall and DMZ topology
      ... > network, Windows and Linux. ... > laptop used as a simple firewall setup. ... > machine and placing it in a DMZ. ... > internal network, one for the DMZ and one for the Internet. ...
      (Security-Basics)
    • Re: Firewall and DMZ topology
      ... >> I would like to set up a SOHO network with a firewall and DMZ for mostly ... >> machine and placing it in a DMZ. ... >> internal network, one for the DMZ and one for the Internet. ... >> The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
      (Security-Basics)
    • RE: DMZ
      ... you've got an internal network consisting of workstations and 1 or more ... or other undesirables would be your DMZ machine which means you can harden ... very secure type of setup as it ensures traffic flows through one and ONLY ...
      (Focus-Microsoft)
    • Re: Merge replication security
      ... I know port 1433 needs to be open for OUTBOUND traffic, ... By having a separate SQL server in the DMZ I can use Windows ... > connect to your SQL Server which is on your internal network. ...
      (microsoft.public.sqlserver.replication)