[zeromq-dev] 0MQ and Firewalls

[John McLaughlin - PTIR]

Is there a officially defined position with regards to 0MQ's ability to
work in a client/server architecture where the client might be behind a
firewall/NAT-router? If so, where can I find this documented?



In this scenario, what is the support for:

1. TCP transport REQ/REP
2. Multi-part messages
3. TCP transport XREQ/XREP
4. TCP transport PUB/SUB (where server is publishing)
5. PGM (where server is publishing)



My assumptions are:

1. You can bind to a TCP socket on the server, and connect to it
with the client for all of the above (1-4).
2. Further, I assume #5 above, PGM (server publishing) would not
work through a firewall.

Can anyone confirm these?



It is easy to make some assumptions about this, and test them to
confirm, but this would not assure their continued support in later
releases.



John



John McLaughlin
PROMISE Technology, Inc.

***@Promise.com <mailto:***@Promise.com>

[Pieter Hintjens]

On Tue, Oct 5, 2010 at 4:01 AM, John McLaughlin - PTIR

Is there a officially defined position with regards to 0MQ’s ability to work
in a client/server architecture where the client might be behind a
firewall/NAT-router?  If so, where can I find this documented?

The connectivity guarantees are exactly those defined by each
transport. Thus with TCP you can create outgoing connections across
firewalls/NAT, but not incoming ones.

0MQ supports this insofar as it lets you switch the connect/bind roles
arbitrarily, so your 'server' can connect to your 'client' if the
server is on the inside of the firewall/NAT.

It's orthogonal to messaging patterns and multipart. PGM is
disconnected and does not cross firewalls/NAT (afaik) unless
explicitly forwarded.

If you need this to be formally specified the right place would be the
reference manual: http://api.zeromq.org/zmq_tcp.html

-
Pieter Hintjens
iMatix - www.imatix.com

[Steven McCoy]

1. Further, I assume #5 above, PGM (server publishing) would not work
through a firewall.
PGM can work fine through a configured firewall, if you really would want

to is another question. The firewall will slow down all packets and you
will need some pretty good hardware to keep up with the high packet rate
when at full speed. 29 West has some good information on firewalls and
multicast performance.

If we're talking about core routers then with IPv4 by default you are not
going to have any multicast routing and so it needs to be added. You would
also need to allow unicast traffic from receiver to source unless you have a
PGM Router Assist enabled router with it enabled.

It is a complicated topic and needs significant planning from your network
team to determine the scope of the multicast traffic and your site routing
policies. You might also need to bring in your vendor to determine whether
you need to upgrade your network hardware to sufficiently support your
requirements.

The 0MQ documentation includes some notes on using 0MQ devices to simplify
routing and thereby simplify firewall configuration by deploying PGM to TCP
forwarders.

PGM and NAT is another question, I don't think you will find multicast and
UDP unicast is going to work too well there unless you are using a
uni-directional broadcast with no back channel and presumably FEC for
repairs.