Showing posts with label dmz. Show all posts
Showing posts with label dmz. Show all posts

Sunday, March 25, 2012

connecting to SQL DB through a firewall

Hi there!

I'm a bit new to all this, so please bear with me! :)

I've got a webserver in our DMZ and I'm trying to create an ODBC connection from that server to a db server within our firewall. When I try and connect, the following message appears:

Connection failed:
SQLState: '01000'
SQL Server Error: 10060
[Microsoft][ODBC SQL Server Driver][TCP/IP Sockets]ConnectionOpen (Connect()),
Connection failed:
SQL State: '08001'
SQL Server Error: 17
[Microsoft][ODBC SQL Server Driver][TCP/IP Sockets]SQL Server does not exist or access denied

I'm at a bit of a loss as to what's going on, as we have an application on the webserver that connects to another SQL DB server within our firewall with no problem!

webserver:
OS - win2000 standard server sp4

db server:
OS - WinNT 4.0
SQL - 7.0

If anyone can help, it would be much appreciated!!

Cheers,

Ewan :)I'd recommend (so does MS) to have a VPN tunnel for intrasver communications, especially if they are on opposite sides of the firewall.

Wednesday, March 7, 2012

Connecting to a remote server

We are setting up a webserver (172.16.0.2) that lives in the DMZ behind our
firewall (172.16.0.1)
I would like this server to connect to a db that lives on an SQL Server
(PDC: 192.168.16.2) on our internal lan.
I have opened port 1433 on the firewall between 172.16.0.2 & 192.168.16.2
On the webserver I have installed MSDE that the web app currently connects
to successfully whilst I determine how to connect it to the internal server.
In EM on the SQL Server I can now connect to the MSDE server, have activated
TCP/IP 1433 on MSDE, and all works well.
I would like our Web application to used the internal SQL Server as opposed
to the local MSDE.
In order to connect to the SQL Server at 192.168.16.2 is MSDE required or
can it be removed ?
Do I simply need to specify the port in the querystring in order to connect
to the remote server ?
What users/logins will need to be created in order for the web app to
connect to our internal server ?
Should I use a trusted connection or specify uid=sa;pwd=abc in the
querystring ?
The querystring I have developed so far to connect to this server is:
<appSettings>
<add key="ConnectionString"
value="server=192.168.16. 2,1433;Trusted_Connection=true;database=
store" />
</appSettings>
Or should I use:
<appSettings>
<add key="ConnectionString"
value="server=192.168.16.2,1433;uid=sa;pwd=abc;database=store" />
</appSettings>
Any assistance would be greatly appreciated.
Thanks
MurphyAs a general comment you are better off not putting real IP Addresses in thi
s newsgroup (as it is open to hackers etc).
No, you don't need MSDE on the webserver (unless it is running Application C
enter 2000 which uses MSDE internally).
Two documents well worth the read are in the Architecture Blueprints (network_architect
ure.doc and security_architecture.doc) of the MS System Architecture 2.0 reference arch
itecture kit. http://www.microsoft.com/windowsser...sa/default.mspx
There is a good article on different security architecture models for .NET/S
QL applications here that's worth a read:
http://msdn.microsoft.com/library/d.../>
Netch12.asp|||Do I simply need to specify the port in the querystring in order to connect
to the remote server ?
What users/logins will need to be created in order for the web app to
connect to our internal server ?
Should I use a trusted connection or specify uid=sa;pwd=abc in the
querystring ?
The port is not required. SQL clients default to port 1433.
The logins required depends on your application.
MSDE is not required on the webserver.
The IIS server is the client to the SQL Server in your case.
You can't make Trusted Connections using a username and password.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Thanks Kevin,
If I need other than the username and password to make a trusted connection
with the web server & sql server are in different domains what is be best
approach. I am now able to connect using sa & password in the querystring
but I'd prefer the trusted connection option...
Thanks
Murphy
"Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> wrote in message
news:FKpYx6cHEHA.1988@.cpmsftngxa06.phx.gbl...
> Do I simply need to specify the port in the querystring in order to
connect
> to the remote server ?
> What users/logins will need to be created in order for the web app to
> connect to our internal server ?
> Should I use a trusted connection or specify uid=sa;pwd=abc in the
> querystring ?
> The port is not required. SQL clients default to port 1433.
> The logins required depends on your application.
> MSDE is not required on the webserver.
> The IIS server is the client to the SQL Server in your case.
> You can't make Trusted Connections using a username and password.
>
> Thanks,
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>|||From previous post:
"If I need other than the username and password to make a trusted connection
with the web server & sql server are in different domains what is be best
approach. I am now able to connect using sa & password in the querystring
but I'd prefer the trusted connection option..."
Trusted connections rely on NT credentials. So if the machines are in
different domains, then there is no way
to correctly "impersonate" the client machine.
So, if you have two domains that are not Trusted, then the only way to make
this work is to duplicate the same NT username & password in each domain.
This technique is called "Workgroup Security".
It's more work on the administrator to keep the NT passwords in synch at
each domain, but it allows you to use NT credentials instead
of passing a SQL username and password.
If you put a Server certificate on the SQL Server , then the logins passed
will be encrypted. Additionally, you could enable SSL encryption between
the IIS machine and Server, which would encrypt both the logins and the
data.
See this article for steps to implement SSL
276553 HOW TO: Enable SSL Encryption for SQL Server 2000 with Certificate
Server
http://support.microsoft.com/?id=276553
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.

Sunday, February 12, 2012

Connect to SQL through firewall?

Hi,

I have a webserver sitting on the DMZ part of the firewall and my SQL Server sitting on the LAN side. I am trying to connect to the SQL Server using SqlConnection class. All ports are correctly opened and authentication is set to mix-mode. Can I do it without using Oledbconnection?

Connection Details
ConnectionString: "data source=mysqlserver;initial catalog=Northwind;persist security info=False;user id=webuser;pwd=password;workstation id=webbill;packet size=4096"
Client Network Utilitly: Server alias "aliassqlserver" created for mysqlserver using TCP/IP, servername poiting to the IP address of mysqlserver, dynamicall determine port. "aliassqlserver" comes up in the Enterprise manager, and can be connected using "sa". "webuser" permissions have been checked with access to Northwind.

Thanks in advanced guys...

PaulWhat error are you getting? What firewall do you have? Can you ping any computer on the DMZ side from the LAN side? The best thing is to start without any firewall rules.

- Boris

Connect to SQL Server from ASP.Net and through firewall

We have a development SQL Server 2000 (running on Win2K SP4) machine that we want to move into our DMZ and access it via the internet and our internal LAN. We have opened the firewall to allow our applications on the LAN to connect to SQL server in the DM
Z.
We connect to SQL Server using the .Net SQLConnection class and using a SQL Server username and password (i.e. sa/password). Also we connect to SQL Server from WinForm and ASP.Net applications using an alias defined using Client Network Utility.
The problem comes when we try to connect to SQL from the LAN from an ASP.Net application. In that case I get "SQL server does not exist..." error. Connecting from a WinForm application works fine.
So to summarise: I run the same connection code (and connection string) on the same client machine to connect to a SQL Server 2000 database via a firewall. The WinForm application works fine, the ASP.Net application throws an error. The connection code an
d connection string are identical.
Can you suggest why this is happening? We have traced the firewall traffic and nothing appears to be blocked.
The connection code follows: (we use an alias for a server name)
'----
Public Shared Function CreateConnection(ByVal aServerName As String, ByVal aDatabaseName As String, ByVal aUserName As String, ByVal aPassword As String) As System.Data.SqlClient.SqlConnection
Dim connectionString As String
Dim connection As System.Data.SqlClient.SqlConnection
connectionString = "server=" + aServerName + ";database=" + aDatabaseName + ";user id=" + aUserName + ";password=" + aPassword
connection = New System.Data.SqlClient.SqlConnection(connectionStri ng)
connection.Open()
Return connection
End Function 'CreateSession
Thanks,
Scott Simms.
Hi Scott,
I learned you ran the same connection code (and connection string) on the
same client machine to connect to a SQL Server 2000 database via a
firewall. The WinForm application works fine, but the ASP.Net application
throws an error.
This problem is strange. Please make sure the server name is correct and
the user account used in the connection string is listed in the SQL Server
logins list.
In Query Analyzer, you can use the following sql statements to check the
logins list on the destination server.
Use master
Select * from syslogins
Please help collect the following information so that I can narrow down
this problem.
1. Please try to create a sample connection web project using the
connection string directly without variables. Please make sure the server
name and user account/password is correct. Did the same problem persist?
2. How did you configure the alias? Did you use named pipes? If so, Please
configure a TCP/IP alias and forcing the connection string to use TCP/IP.
To do this, add the following attribute to the connection string:
"Network Library =dbmssocn"
What's the result?
3. If it is possible, please try the standard SQL client tools, such as
Query Analyzer, connecting to the SQL Server via firewall using the same
sql account. Did the same problem occur again?
I also found the following articles for your reference.
315159 BUG: Named Pipes Do Not Work When Worker Process Runs Under ASPNET
http://support.microsoft.com/?id=315159
328306 INF: Potential Causes of the "SQL Server Does Not Exist or Access
http://support.microsoft.com/?id=328306
I am looking forward to hearing from you soon.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
|||Hello,
How is the issue going on your side? Please try to change the process
acount from "machine" to "SYSTEM" in the machine.config 's <processModel>
element. Does the same problem persist?
I am looking forward to hearing from you soon.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
|||Hello,
How is the issue going on your side? Let us know if you need further
assistance.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
|||Yuan,
We have very simlar issues ast Scott's in our company. Our web server is inside our firewall. And our custom SQL server is inside their firewall. But the network folks told us that both sides was opened. Our custom side opened port 1433. But I just can n
ot connection. Here is the connection string:Password=xxxx;Persist Security Info=True;User ID=xxx;Initial Catalog=DBNAME;Data Source=IDaddress;Network Library=dbmssocn
Can you help?

Connect to SQL Server from ASP.Net and through firewall

We have a development SQL Server 2000 (running on Win2K SP4) machine that we
want to move into our DMZ and access it via the internet and our internal L
AN. We have opened the firewall to allow our applications on the LAN to conn
ect to SQL server in the DM
Z.
We connect to SQL Server using the .Net SQLConnection class and using a SQL
Server username and password (i.e. sa/password). Also we connect to SQL Serv
er from WinForm and ASP.Net applications using an alias defined using Client
Network Utility.
The problem comes when we try to connect to SQL from the LAN from an ASP.Net
application. In that case I get "SQL server does not exist..." error. Conne
cting from a WinForm application works fine.
So to summarise: I run the same connection code (and connection string) on t
he same client machine to connect to a SQL Server 2000 database via a firewa
ll. The WinForm application works fine, the ASP.Net application throws an er
ror. The connection code an
d connection string are identical.
Can you suggest why this is happening? We have traced the firewall traffic a
nd nothing appears to be blocked.
The connection code follows: (we use an alias for a server name)
'----
Public Shared Function CreateConnection(ByVal aServerName As String, ByVal a
DatabaseName As String, ByVal aUserName As String, ByVal aPassword As String
) As System.Data.SqlClient.SqlConnection
Dim connectionString As String
Dim connection As System.Data.SqlClient.SqlConnection
connectionString = "server=" + aServerName + ";database=" + aDatabaseName +
";user id=" + aUserName + ";password=" + aPassword
connection = New System.Data.SqlClient.SqlConnection(connectionString)
connection.Open()
Return connection
End Function 'CreateSession
Thanks,
Scott Simms.Hi Scott,
I learned you ran the same connection code (and connection string) on the
same client machine to connect to a SQL Server 2000 database via a
firewall. The WinForm application works fine, but the ASP.Net application
throws an error.
This problem is strange. Please make sure the server name is correct and
the user account used in the connection string is listed in the SQL Server
logins list.
In Query Analyzer, you can use the following sql statements to check the
logins list on the destination server.
Use master
Select * from syslogins
Please help collect the following information so that I can narrow down
this problem.
1. Please try to create a sample connection web project using the
connection string directly without variables. Please make sure the server
name and user account/password is correct. Did the same problem persist?
2. How did you configure the alias? Did you use named pipes? If so, Please
configure a TCP/IP alias and forcing the connection string to use TCP/IP.
To do this, add the following attribute to the connection string:
"Network Library =dbmssocn"
What's the result?
3. If it is possible, please try the standard SQL client tools, such as
Query Analyzer, connecting to the SQL Server via firewall using the same
sql account. Did the same problem occur again?
I also found the following articles for your reference.
315159 BUG: Named Pipes Do Not Work When Worker Process Runs Under ASPNET
http://support.microsoft.com/?id=315159
328306 INF: Potential Causes of the "SQL Server Does Not Exist or Access
http://support.microsoft.com/?id=328306
I am looking forward to hearing from you soon.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||Hello,
How is the issue going on your side? Please try to change the process
acount from "machine" to "SYSTEM" in the machine.config 's <processModel>
element. Does the same problem persist?
I am looking forward to hearing from you soon.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||Hello,
How is the issue going on your side? Let us know if you need further
assistance.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||Yuan,
We have very simlar issues ast Scott's in our company. Our web server is ins
ide our firewall. And our custom SQL server is inside their firewall. But th
e network folks told us that both sides was opened. Our custom side opened
port 1433. But I just can n
ot connection. Here is the connection string:Password=xxxx;Persist Security
Info=True;User ID=xxx;Initial Catalog=DBNAME;Data Source=IDaddress;Network L
ibrary=dbmssocn
Can you help?