Using a Dell DRAC virtual console through a NAT firewall

Question

I have two Dell Poweredge R210 servers, both running Ubuntu 10 Server x64.

Server A has a Dell iDRAC6 Enterprise ILO card (on 172.16.96.91), and both the server and the DRAC use Server B as a gateway (with server B's WAN IP being xxx.xxx.xxx.xx). Server B uses the following NAT rules in IPTables to route traffic through to Server A's DRAC:

*NAT

--append PREROUTING --in-interface eth1 --protocol tcp --destination xxx.xxx.xxx.xx --destination-port 8019 --jump DNAT --to-destination 172.16.96.91:443

--append POSTROUTING --out-interface eth1 --jump SNAT --to-source xxx.xxx.xxx.xx

This works fine for accessing Server A's iDRAC via Server B, apart from the Java virtual console. This fails with the following error:

com.sun.deploy.net.FailedDownloadException: Unable to load resource: https://xxx.xxx.xxx.xx:443/software/avctKVM.jar
at com.sun.deploy.net.DownloadEngine.actionDownload(Unknown Source)

etc.

I know that the Java console uses port 5900, and possibly ports 83 and 5891.

Can anyone help me in getting this working?

Solution

The trick is not to change the port in iptables' NAT configuration, but to change it on the DRAC. Changing the DRAC port to 8019 and changing the iptables rule to:

--append PREROUTING --in-interface eth1 --protocol tcp --destination xxx.xxx.xxx.xx --destination-port 8019 --jump DNAT --to-destination 172.16.96.91:8019

gets things going a little further before failure. Adding:

--append PREROUTING --in-interface eth1 --protocol tcp --destination xxx.xxx.xxx.xx --destination-port 5900 --jump DNAT --to-destination 172.16.96.91:5900

gets the console and remote media functionality working 100%. As the DRAC also offers the functionality to change port 5900, I'd imagine it'd be safe to move this to a different port.

Comments

[mbrownnyc]

possible answer: stackoverflow.com/questions/2643893/…

[Nils]

Which kind of DRAC is this? DRAC5? iDRAC6 (Enterprise)? They behave quite different when it comes down to the java console.

[jetboy]

iDRAC6 Enterprise. I've amended the original question to reflect this.