How to access a web service behind a NAT?

Question

We have a product we are deploying to some small businesses. It is basically a RESTful API over SSL using Tomcat. This is installed on the server in the small business and i

Answer 1

It's things like this that are the reason people are tunneling everything over http now, and why certain hardware vendors charge a small fortune for Layer 7 packet filtering.

This is a tremendous amount of work to fix one problem when the customer has at least three problems. Besides the one you've identified, if they don't know their own password, then who does? An administrator who doesn't work there anymore? That's a problem.

Second, if they don't know the password, that means they're almost certainly far behind on firmware updates to their firewall.

I think they should seriously consider doing a PROM reset on their firewall and reconfiguring from scratch (and upgrading the firmware while they're at it).

3 birds, one stone.

Answer 2

You could try to connect to an pc/ server and tunnel all the data via hamachi (Free VPN Software) because this tool you can install and it will create a reverse connection (from inside your nat to outside) so you can connect to it

site: http://hamachi.cc/

Answer 3

If you want to have a RESTful integration to the client server, a tunnel to the central server that works as a proxy, seems the best approach.

But if this is not a hard requirement, you can let the central server handle the RESTfull stuff and integrate the central server and client server with other middleware. Good candidates would be RMI or JMS. For example, a RMI connection initiated by the client allows the server to do RMI calls to the client.

Answer 4

+1 for going with a SSH tunnel. It's well known, widely available and not too hard to configure.

However, as you point out, you are running SSL already, so the SSH encryption is redundant. Instead of SSH you could just use a regular tunneling proxy, that provides the tunnelling without the encryption. I've used this one in the past, and it has worked well, although I didn't load test it - it was used with just a handful of users.

Here's a blog from someone who used the tunnelling proxy to access his webcam from outside his firewall.

Answer 5

Is there no way this service can by hosted publicly by you or a hosting provider rather than with the customer?

I had a similar situation when i was developing kiosks. I never knew what type of network environment i'd have to deal with on the next installation.

I ended up creating a PPTP VPN to allow all the kiosks to connect to one server i hosted publicly. We then created a controller web service to expose access to the kiosks that were all connected via the VPN. I'm not sure how familiar you are with VPN's but with the VPN connection i was able to completely circumvent the firewall in front of each kiosk by accessing the kiosk via the VPN assigned IP.

Each kiosk node was incredibly easy to setup once i had a VPN server setup. It also brought management benefits and licensing revenue i originally didn't think about. with this infrastructure i was easily able to roll out services accessible via mobile phones.

Best of luck!

Answer 6

Set up an Apache in front of your Tomcat. This Apache should be visible from the internet, where the Tomcat should not.

Configure Apache to forward all traffic to the Tomcat. This can easily be accomplished using mod_proxy (check out the ProxyPass and ProxyPassReverse directives).

Have your SSL certificate located in the Apache, so that all clients can talk HTTPS with the Apache server, which in turn talks plain HTTP with Tomcat.

No tunneling or other nastyness + you will be surprised how easy it is to configure Apache to do this.