0

I'm creating an Android application that uses MQTT protocol to send real time messages, however the local firewall is strict and blocks most ports so the android app can not connect. (Server is outside of the firewall, but users at my location cannot connect through it )

Is it possible to forward non HTTP traffic from port 80 to 1883 or 443 to 8883 server side, while still handling HTTP traffic properly? (I'm aware that some firewalls also block non HTTP over tcp, but at least this can accomodate a few more people)

I have a VPS Linode running NGINX for the web server on CentOS 5.

Improve this question
4
  • To clarify, you are deploying a non-HTTP server application, and you do not have the ability to get a port opened up for it so that people can reach your server?
    – David Schwartz
    Oct 6, 2011 at 15:54
  • Wording remains a tad confusing... Server has all ports open and is accessible globally, but users on local wifi can not reach it as local ports are blocked
    – Evan Elliott
    Oct 6, 2011 at 20:56
  • This is going to sound crazy, but I would strongly suggest simply insisting that the application requires Internet access, full stop. Not web access, Internet access. If people don't have Internet access, they can't use the app.
    – David Schwartz
    Oct 7, 2011 at 1:25
  • Think I'm going to side with that actually... Didn't think it would be a big deal to forward non HTTP traffic but seems like a huge no-no.
    – Evan Elliott
    Oct 7, 2011 at 6:20

1 Answer 1

Reset to default
1

You can write a proxy that intercepts the TCP stream, inspect the first three bytes of data sent by the client, and if they're not all letters (A-Z,a-z) of the same case, consider it to be non-HTTP. Proxy HTTP to a port the web server listens on. Proxy non-HTTP to the port your MQTT server listens on.

This is not strictly correct -- it's a hack. But I've used it successfully to do many similar things. I skimmed the MQTT protocol and it doesn't seem likely that an MQTT message would look like HTTP by this test. If it does, you'll have to check in more detail. For example, check for known HTTP verbs and/or the space after the verb.

I still think the best/right solution is to get a port opened in the firewall. This is an ugly hack that makes the firewall less useful. Anyone authorized to deploy a server application should also have the ability to get a port opened for that application.

Improve this answer
1
  • Problem is android device can't connect to the server port (wifi based firewall). I have free range on the server which is unaffected. I'll try what you said and get back to you
    – Evan Elliott
    Oct 6, 2011 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .