0

I'm creating an Android application that uses MQTT protocol to send real time messages, however the local firewall is strict and blocks most ports so the android app can not connect. (Server is outside of the firewall, but users at my location cannot connect through it )

Is it possible to forward non HTTP traffic from port 80 to 1883 or 443 to 8883 server side, while still handling HTTP traffic properly? (I'm aware that some firewalls also block non HTTP over tcp, but at least this can accomodate a few more people)

I have a VPS Linode running NGINX for the web server on CentOS 5.

Evan Elliott
  • 101
  • 3
  • To clarify, you are deploying a non-HTTP *server* application, and you do not have the ability to get a port opened up for it so that people can *reach* your server? – David Schwartz Oct 06 '11 at 15:54
  • Wording remains a tad confusing... Server has all ports open and is accessible globally, but users on local wifi can not reach it as *local* ports are blocked – Evan Elliott Oct 06 '11 at 20:56
  • This is going to sound crazy, but I would strongly suggest simply insisting that the application *requires* Internet access, full stop. Not web access, Internet access. If people don't have Internet access, they can't use the app. – David Schwartz Oct 07 '11 at 01:25
  • Think I'm going to side with that actually... Didn't think it would be a big deal to forward non HTTP traffic but seems like a huge no-no. – Evan Elliott Oct 07 '11 at 06:20

1 Answers1

1

You can write a proxy that intercepts the TCP stream, inspect the first three bytes of data sent by the client, and if they're not all letters (A-Z,a-z) of the same case, consider it to be non-HTTP. Proxy HTTP to a port the web server listens on. Proxy non-HTTP to the port your MQTT server listens on.

This is not strictly correct -- it's a hack. But I've used it successfully to do many similar things. I skimmed the MQTT protocol and it doesn't seem likely that an MQTT message would look like HTTP by this test. If it does, you'll have to check in more detail. For example, check for known HTTP verbs and/or the space after the verb.

I still think the best/right solution is to get a port opened in the firewall. This is an ugly hack that makes the firewall less useful. Anyone authorized to deploy a server application should also have the ability to get a port opened for that application.

David Schwartz
  • 31,449
  • 2
  • 55
  • 84
  • Problem is android device can't connect to the server port (wifi based firewall). I have free range on the server which is unaffected. I'll try what you said and get back to you – Evan Elliott Oct 06 '11 at 16:37