Firewall problems with new client

[Morphy375]

I got this error on all machines at work. With the old client status check also didn't work but the upload was fine.
A quick status check with IE for this ticket said: 900 OK.

Any hints?


========================[ May 3, 2004 10:44 AM ]========================
Starting foldtrajlite built Apr 28 2004
Mon May 03 10:45:12 2004 ERROR: [000.000] {foldtrajlite2.c, line 2199} Unable to check server status
Mon May 03 10:45:36 2004 ERROR: [000.000] {foldtrajlite2.c, line 4380} Failed to query status for ticket 192.168.10.109_1083573098_27927528011

[tpdooley]

What OS are the work systems running?
If there's a local firewall on each of the work systems, what brand and version number? (I've had end users complain about no email after telling ZoneAlarm and Norton Internet Security's firewall to forbid internet access to OE.. Have your users done the same? :)
If there's a company firewall, what make and version is it (hardware or software)?

That should give enough information for suggestions on how to either track down the problem or cure it.

[Morphy375]

The boxen are dedicated crunchers and are running under W2K SP4. No software firewall installed. Ther'e two instances of company firewalls (Cyberguard?) which I can't tell anything. There's only http open. Ftp and all other ports are blocked.

[Brian the Fist]

Do you receive the error constantly, or just occasionally? It is normal to appear once in a while as it can occur if OUR server is maxxed out on conncections at any given time when your box tries to connect. It will automatically try again later.

[Morphy375]

The error is constantly on all 25 boxen. Does the new client open other ports than the old one? As I said before the clients never got the serverstatus but uploading works fine....

[Morphy375]

Bump.....:notworthy

[Brian the Fist]

Try www.distributedfolding.org/server.status in your browser, does that work?

[Morphy375]

As I wrote in my first post "server status" never worked at work. FTP is blocked and only HTTP is open......

At work I'm running TSC, Lifemapper and DF. TSC and Lifemapper are running still fine. Only DF doesn't upload since the last changeover.

But it's night over here and I will try it again toorrow morning.

edit: At work the client reports always: Unable to check server status.

[bwkaz]

Originally posted by Morphy375
FTP is blocked and only HTTP is open... But that's an HTTP link, not FTP...

[Morphy375]

Originally posted by bwkaz
But that's an HTTP link, not FTP...

You're right. But please read my first post and have a look at the posted part of the error.log. With my Browser I can always check server status and the status of a ticket. The client can't....

[Hagar]

Does your browser use a proxy?

[Morphy375]

Originally posted by Hagar
Does your browser use a proxy?

Yes... The client too....

But my only question is what has changed with the implementation of the ticket system. What other ports are now in use? It works fine for me before and now it hangs..... Other projects work fine behind the same firewalls.....

[bwkaz]

The client does not open up any ports on your machine (both netstat and the fact that I'm running fine behind a custom NAT box attest to that). I have never seen it connect to any other port, either -- of course, that doesn't mean it doesn't for sure, but I don't think it does.

Do you have the option of not requiring the proxy? Since the client doesn't do Windows authentication (whatever the protocol is; I can't remember anymore), I wouldn't be able to use the proxy at work (not that I run the client at work, but that's not the point). But if I just turn the proxy settings off in any browser, I can skip the proxy altogether and act like a normal NAT client to our server. But that depends on the network architecture...

[Morphy375]

Originally posted by Brian the Fist
Try www.distributedfolding.org/server.status in your browser, does that work?

It works....

135 119 121 5000 135 119 121
SERVER DOWN FOR MAINTENANCE, TRY AGAIN LATER
ftp.mshri.on.ca /pub/distribfold/download/patch/
distfold.paratima.com /

[Stardragon]

Are you able to try the connection without the proxy on the same machine? There have been no port or machine changes for the client, so it seems like something is not fully compatible with your configuration. The accepted proxy authorizations are only NTLM and basic.

Is it possible you have changed your proxy setup? Try to port-sniff when the client is making the request for server.status, and let us know what the response that comes through is.

[bwkaz]

Originally posted by bwkaz
Since the client doesn't do Windows authentication (whatever the protocol is; I can't remember anymore),
Originally posted by Stardragon
The accepted proxy authorizations are only NTLM and basic. Seems I was wrong; NTLM is supported.

Thanks for the correction, Elena!

[Brian the Fist]

Yes, if you need us to suggest a good port sniffer let us know your OS. That is the quickest way to debug a problem like this, to see the actual server response.

[Morphy375]

Originally posted by Stardragon
Are you able to try the connection without the proxy on the same machine? There have been no port or machine changes for the client, so it seems like something is not fully compatible with your configuration. The accepted proxy authorizations are only NTLM and basic.

Is it possible you have changed your proxy setup? Try to port-sniff when the client is making the request for server.status, and let us know what the response that comes through is.

I'm not able to try the connection without the proxy. Without proxy.cfg there's no connection at all. With proxy I get a receipt.txt and that's it. I need no authorization because the crunchers are acknowledged by their IP.

I didn't change anything in my setup. I installed the new client in an empty directory, copied proxy.cfg and handle back and started the client.

Today I asked the firewalladmins. They changed nothing... Lifemapper and TSC are still running...

And sneakernetting is no solution. Last night it took six hours to upload the results on one machine at home with four tasks. Got 5 million points....

Thanks for trying to help.

[Morphy375]

Originally posted by Brian the Fist
Yes, if you need us to suggest a good port sniffer let us know your OS. That is the quickest way to debug a problem like this, to see the actual server response.

Do You know some share/freeware for W2K? ;)

[Stardragon]

Try the ethereal network protocol analyzer from www.ethereal.com. It is free to use, and runs well under Windows.