4.5. VOS with Firewalls and NAT Gateways

VOS follows a peer-to-peer model where any site is expected to be able to contact any other site directly. This creates problems with clients that access the internet through firewalls or gateways using network address translation (NAT), because your local site must be able to make available an open port for other sites to contact. There are two ways to configure your network such that hosts on the internal network can use VOS on the internet: use SOCKS, or manually forward ports on your firewall/gateway.

4.5.1. SOCKS

VOS supports the SOCKS protocol (v5) for communicating with the firewall to setting up port forwards. VOS uses the Dante SOCKS library, which is available under a free (BSD style) license.

Here's what you have to do to get VOS working with SOCKS:

    1. If you have a SOCKS server already: In this case, you need to find out if it supports the BIND method, and if this feature is enabled. Consult your sysadmin. If you ARE your sysadmin, consult your firewall/gateway configuration tools and documentation.

    2. If you don't have a SOCKS server, and your firewall/gateway is some sort of Unix: Install (or ask your sysadmin to install) the server that comes with the Dante SOCKS package (you will need this package for the client anyway.)

    3. If you don't have a SOCKS server, and your firewall/gateway is some sort of Windows: I don't know anything about Windows SOCKS servers. E-mail me if you have any suggestions!

  1. The SOCKS client libraries

    1. If you're building VOS on a Unix: Get the Dante SOCKS package. Currently we recommend downloading the following known working version from our web site: http://interreality.org/software/dante_1.1.11.12p1-3.tar.gz Alternately there is a new release available from the official Dante web site which may work just as well. You will need to build/install/configure this seperately before compiling VOS.

      If you use Debian you may install the following packages: (you want version 1.1.11.12p1-3 or better!)

      • dante-server

      • libsocksd-dev

      Please note that there are several severe bugs in several official releases of Dante (1.1.10, 1.1.11, and 1.1.12pre1) which render these versions useless for VOS's purposes, so for the time being you must use either the version distributed on the Interreality.org web page or the Debian packages.

    2. If you're building VOS on Windows: Again, I don't know about the options for this platform.

  2. (Re-)Run the VOS configure script. It should detect the library "socks" or "socksd". This will enable socks support to be built in VOS.

  3. Important: before running any VOS applications, set the environment variable VOS_USE_SOCKS (to any value) (this will enable the SOCKS code), and also set VOS_HOSTNAME to the internet host name of your firewall. (See the next section for more about environment variables.)

4.5.2. Manual Port Forwarding

You can also configure your firewall/gateway to "forward" ports from the external network to certain hosts in the internal network. When a VOS site is created, it searches for an available port starting at port number 4231 (The service list daemon typically uses this port). Set up your firewall/gateway to forward several ports starting at 4231 (or 4232 if you don't want the service list daemon accessible from outside) to hosts inside the network. Then, before you run a VOS application on a host inside the network, set a VOS_HOSTNAME environment variable to contain your gateway's Internet hostname and the forwarded port number (e.g. example.dyndns.org:4232) See the next section for more information about VOS environment variables.