Re: Socket Programming -- MIDRANGE-L

Okay, the 10.10.xxx.xxx is a "private" network, and can only be seen by
machines on the same "wire", that is, your local network.  That address range
can not "see" the internet.

The 207.70.xxx.xxx address is on the "public" network (internet) and can be
seen by any machine on the internet.

The test IIS box, as you state, has the 10.10.xxx.xxx address so can see the
AS/400, as they have the same address subnet, and are on the same "wire".

So, the question is, how do you get a machine on the internet to see your 
AS/400?

There are a number of ways.

1. Give your AS/400 a "public" network address, 207.70.xxx.xxx that you have
available.  This opens up a can of worms, however, that now you really really 
have
to take a very close look at all the security on your AS/400 (ftp, telnet, 
http, etc...).

2. Use some type of proxy server for the connection.  This can be complicated, 
however,
by the fact that it is very easy to initiate an outgoing connection (from your 
AS/400 to the
public remote IIS server) but very hard to initiate an incoming connection 
(from the remote
IIS to your AS/400).

3. Create a custom proxy program on a machine that can see both the public 
internet and
the private network.  This machine would have both ip addresses (a proxy server 
has 2
ip address, one for the public and one for the private).  This program would 
accept any
open request on a certain port (pick your own) and forward it on to the other 
machine.
That is, if it gets a request from 207.70.xxx.xxx (your remote iis server) it 
would then open
a TCP/IP socket to your 10.10.xxx.xx box and forward on the information.  It 
would work
as in intermidiary.  This is exactly the way proxy servers work.  It is not a 
difficult program,
but whoever writes it has to understand socket programming on NT machines.

4. There is something called "IP Forwarding" that I am not sure how it works.  
This might
do it for you.  Rather than a proxy server, set up a machine with duel IP 
addresses (one for
your public and one for your private) and there is a checkbox somewhere under 
the TCP/IP
properties for "IP Forwarding".   Again, I think this would only work for 
outgoing requests,
though, and I am quite sure there are all kind of security issues involved, I 
would not take this
course of action lightly.

5. Forget talking directly from the remote public IIS server.  Have your remote 
IIS server talk
to a PC in your office and request data from there.  Then have your local IIS 
server request that
data from your AS/400.

Now, these are a lot of suggestions, some good, some bad.  You have to look at 
the security in
your office and how comfortable you are with opening your AS/400 to the 
internet.  I do think the
order I would do them in is:

#1 first.  Set up the security and put your AS/400 on the internet.  Easiest 
way in the long run, and
not much of a head ache.  Now you can also set up the POP3 and SMTP services on 
it too, and
perhaps set up the HTTP server, FTP server, etc.. and really be able to 
communicate.

#3 next.  You don't want to open up your AS/400 to the internet, so create a 
custom proxy program
to handle the communications.  This talks on one specific port you specify and 
is very secure.  You
wouldn't have to change any of the existing program either to get this to work, 
just make a new program.

#2.  You don't want to write your own proxy program, use a normal one, but you 
are going to spend
forever and a day trying to figure out how to route a specific incoming port 
request to a specif ip on your
network.  Maybe it's easier than I think it is, but I doubt it.

#5.  Don't even worry about the IP forwarding of any type, just proxy the data 
requests them selves.  This
will dramatically slow down the process though.

#4 last resort.  I don't even know if this will work, I've just seen the little 
check box and I *think* this is
what it will do.  I think this would be the same as opening up your network to 
the internet though.  I would
only attempt this as a last resort, as I said.

Good luck.

Regards,

Jim Langston

Date: Thu, 20 Jul 2000 06:58:22 -0600
From: Cyndi Bradberry <CyndiB@IHFA.ORG>
Subject: Socket Programming

Hi All,

We have just delved into using sockets instead of ODBC to communicate
bewteen an NT IIS server and the AS/400. Wow ! is it fast.  We had no
problems on our test system, but we tried to go to our live system and ran
into a problem.

Our internal network is a 10.10.x.xxx  and of course, both the AS/400 and
the test IIS box are on this network. The production IIS server is outside
our network with a 207.70.xxx.xxx address.  When we try to open a connection
to the AS/400, we are using the 10.10 address and it is not working.  Does
this have something to do with the NAT ?

I have only a very rudimentary understanding of routing (but I'm learning !)
and our network guy is less than helpful.

TIA for any ideas,

Cyndi
Boise, ID

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---