Multiple Lookouts behind a firewall

[vorlon]

I currently have three Lookout server machines running behind a firewall at a plant in the midst of a major automation upgrade. One is responsible for powder transportation, one for liquids, one for power quality/consumption monitoring. At the moment, I am trying to make only the third accessable from the outside internet. I do know that my firewall is capable of redirecting ports (ie, I can talk to my UPS system by redirecting external port 20023 to internal port 80).
Particulars...
-NAT is involved.
-All UDP packets are allowed through in both directions.
-The firewall machine is running OpenBSD 3.3-STABLE, pf.conf attached

[Carl_Finley]

I just went through a major dealing with NI about this. It seems that Lookout 5.1 (this is what I am using, you did not mention your revision) webclient will not work through a firewall unless it performs "packet filtering" ONLY. I can make mine work also if I redirect ports,although I haven't been able to read live data and see trends at the same time, but it isn't supposed to be that hard. Port usage is dynamic and NI suggests that you open 60000 ports on your firewall. My firewall cannot do that. After investing alot of time, I still am sitting at zero and will probably abandon the idea of the webclient EVER working on anything other than inner-office intranet. My problem was written up and sent to NI's R&D, the answer I got was "you're right, it doesn't work." I'm
sure this is not the answer you were wanting to hear, but if you do figure out how to make it work let me know also.

[mark@no.email]

Have you checked this doc?
http://zone.ni.com/devzone/conceptd.nsf/webmain/7D0E7F20B1A7C8E486256A39005747F2?opendocument&node=DZ52188_US

Hope it helps.

Mark

[vorlon]

Ahh, yes. Forgot to mention the version. Like you, I'm running rev 5.1.

While I have the ability to "open the floodgates" and direct all traffic to the first system, that totally defeats the purpose of a firewall, nor does it address the issue of how to add the other two process machines at a later time. Quite frankly, I don't see why it should be so difficult to implement. I can understand hypertrends not working (since that would require a local copy of the Citadel db), but everything else seems to be nothing more than a glorified Active-X control, which *SHOULD* be accessed by hitting up port 80 of the server machine, and that should be all that's needed. If NI is off and using non-standard ports, or (gag) NetBIOS, then I'll have little choice but to de
clare it a broken package.

[vorlon]

Yes, I've read it a number of times, as well as 2GD9CL6Q (What Ports Do I Need to Open on My Firewall for National Instruments Software Products). Quite frankly, it's a non-starter. Its first "hint" is that allowing all outbound UDP traffic is necessary. No problem. Next, I need to open/redirect ports 80 (for the initial HTTP request) and 2343 (LOGOS). Done. The problem is twofold. First, the last page implies that the server address is embedded into the packets being sent (which I can see no need for), and that unless that address can be resolved to a specific machine, things won't work. This is silly. Second, it prevents multiple servers from being accessed, since only one internal port (Say, 80) can be redirected from an outside port (like 24501). If
I redirect external 2343 to a specific internal 2343, ONLY that machine will be able to serve over the internet, and my other two will continue to be shut out. This is not acceptable.