Help setting up Smoothwall firewall to a Citrix server.

[tickmike]

Hello All,

 

I need help accessing the school@home link to my daughters school ( its not the one I help ) .

 

The problem at home I have 'smoothwall exp 2' firewall on my network and I cannot get her homework link working though smoothie to her school (It works ok with out smoothie in circuit ).

I log on to her school, click the school@home link, Accept the security certificate, enter user name and password , click on say MS Word the citrix plug-in starts Then I get a error message....

"cannot connect on to citrix metaframe sever.. proxy connection failed the configured proxy server refused to establish a connection. click ok"

 

On smoothwall >Networking>external services access .. I have set up

1..The school IP address and the port 1494

2..The school IP address and the port 443

 

But having tried it again and again then finding smoothie is blocking ports 45674,75,76,77 and 78

 

Do I have to enable all these ports or am I going about this wrong.

 

I have asked the technician at her school ( one of our members ) but he does not not know about smoothwall.

 

Regards Michael.

[Ric_]

Sounds like an antiquated version of Citrix is being used (hence all those high ports). V3+ simply uses 1494 and 443 (or 80 if unsecured).

 

In the ICA client settings it might be worth setting up the proxy info too. There is a tab called 'Firewall' or 'Proxy' or something.

[tickmike]

Hi Ric.

Thanks for reply.

 

I have just tried to access my daughters school from home, but no luck, I looked on my smoothwall proxy log its got there schools IP address and port 443 and a second entry with port 1494 and NO entries in the firewall blocking log. (but yesterday it was blocking the high port numbers ..odd.)

 

Re. "In the ICA client settings it might be worth setting up the proxy info too. There is a tab called 'Firewall' or 'Proxy' or something."

Do you mean on my smoothie ?.

 

Or have they got to do this at her school ?.

 

From Michael.

[Ric_]

The client has a proxy/firewall/something section. Not on a Windoze box at the mo so cannot remember exactly. You should have a Citrix program group with either Program Neighborhood (that is how it is spelt!) or Connection Manager.

[Ric_]

Of course, if you are using the Web client, it may not have installed the full client... you can grab this from http://www.citrix.com

[CyberNerd]

telnet can be a useful debugging tool in this sort of situation to check connectivity to the Citrix service on port 1494.

from your come machine try:

 telnet school.county.sch.uk 1494 

if you get something along the lines of connected to ..... then you know that its an application error and nothing to do with your smoothie

[Ric_]

It's more likely to be the web port (443) that you are having difficulty with... hence the proxy bit.

[tickmike]

Hi Ric/cyberNerd

Ric

I have the citrix client installed and have port 443 enabled on my smooth box.

 

CyberNerd

It a long time since I have used Telnet, but I think I have used it correctly.

and it said "could not open a connection to host on port 1494 connection failed"

 

CyberNerd I have sent you a PM.

 

 

I'm using a different computer than earlier ( this one does not have a soft-ware firewall installed ) .

I have tried a connection in the normal manner to my daughters school and this time my smoothie has now blocked port 48413 and 48444 why so many different ports. (that's 7 with the ones on my first post ! )

 

Michael

[Ric_]

As I mentioned earlier, version of Metaframe/Presentation Server prior to V3 (IIRC) used a randomly selected port in a 48xxx range. This caused pains for people using firewalls which is why Citrix improved the way the server works.

 

You could try the Citrix forums... the users on there are REALLY helpful and you are pretty much guaranteed a good reply within a few hours.

[tickmike]

Thankyou ..Ric have a guess were I was just, On the 'Citrix' forums (great minds think a like)

 

I have come across other people on that forum having the same problem.

 

The Technician at my daughters school said to me no body else is having problems, I bet I'm the only one that's got a good firewall and nobody else has a proxy server.

 

I will keep you up to date with what I find as it may help other members .

 

 

Michael.

[Ric_]

@tickmike: If possible, it might be worth finding out what Citrix product they run (plus version) as it might be a quirk with a particular product.

[tickmike]

Its "MetaFrame presentation server web client for win 32 ica32t.exe" that's what I have installed the latest one ,

The school tech told me to update this the other week.

[Ric_]

Its "MetaFrame presentation server web client for win 32 ica32t.exe" that's what I have installed the latest one ,

The school tech told me to update this the other week.

 

Sorry... I meant the server-side product (MetaFrame/Presentation Server/Secure Gateway/etc.). It's also possible to change the ports that Citrix operates on. Usually the client works all this out but Smoothwall may be blocking this autonegotiation somehow so check the port numbers.

 

I would also tell the IT guy to stop being an arse and help out. You've clearly tried the obvious stuff and it's surprising that he's not being more helpful.

[tickmike]

I will call to see him tomorrow because I'm going right past the school on my way to do some xmas shopping.

Michael

[tickmike]

Hello.

 

Because I was short of time I had to email the school ICT Systems Manager and all he can tell me was they are using Citrix Metaframe XP 1.0a

I could not join the forum on 'citrix' site, you must have an account with them, but there seems to be problems with citrix and proxy connections.

Remember I'm on the client end trying to access the citrix school homework server for my daughter to do her homework.

My set up is BT phone line with ADSL>none NATing router set up with a set of public IP's > smoothwall firewall with proxy server > network switch> LAN > workstations with W2K Pro. using Firefox browser.

Does any one know how to help me connect though my firewall and proxy to her school citrix server.

Is the problem with the school ?.

or is the problem with my firewall and proxy.?.

please read through all the above post.

 

From Michael.

[CyberNerd]

from the info you gave in your pm, I was able to connect to the schools ica service using telnet on port 1494. There isn't a problem at the schools end unless it is selectively blocking your ip on 1494 which is unlikely.

Get the telnet trick working from your end, try first by bypassing smoothwall to try and narrow the problem down. If you can get access to 1494 without smoothwall, then add smoothwall back into the equation. Once you are sure you can access the ica service then start worrying about application layer problems eg the ica client and browser.

 

I assume BT don't treat ica traffic as some sort of 'bad' filesharing/gaming traffic and block it?

[tom_newton]

SmoothWall Express shouldn't block anything outgoing by default... drop me a line if you're still getting problems.

 

tom

[Ric_]

Your problem lies in the fact that Metaframe CP 1.0a was released eons ago and does that stoopid random port thing that I mentioned.

 

Try opening all ports in the range 4000-4999 (I can't remember the exact range so this many will help you prove the concept).

[tickmike]

Thanks for replies... cybernerd , thanks for offer Tom and Ric see below

 

What I have tried today .

 

Connected to internet via Broadband router (public IP) and computer with software firewall (no smoothwall)

 

could connect to school site ok >log on to school at home ok no problems !

 

Then tried telnet > open (school ip) port 1494 = failed

 

So now tried on DIAL-UP on a Different ISP.

connected to school ok > school at home ok

 

Then tried telnet > open (school ip) port 1494 = failed

 

Then tried dial-up with smoothwall (another smoothie box ) connected to school site ok ..then school at home failed..

 

Ric

I have opened port 443, 1494, 1604

my firewall has blocked these ports on different times I have tried to make a connection.

45674,45675,45676,45677,45678,48413,48444,51302,51298,51305,51301,51504,51505.

 

So as a temporary solution if I open ports 40000 to 60000 on the school IP would that do the trick ?.

 

I have sent the schools ICT manager a link to this post and said about there citrix software needs updating.

 

Regards Michael.

[Ric_]

I have sent the schools ICT manager a link to this post and said about there citrix software needs updating.

 

It's not fair to say that they NEED to upgrade... just that newer version have some nice features for publishing servers to the web... including make them more easily available through firewalls. IIRC bandwidth and system resource usage has improved too.

[CyberNerd]

surely Citrix XP1 is still supported?

Without subscription advantage upgrade would be a major cost.

 

anyway, I tried from here again- using the citrix client and it connect to a win2003std server called Citrix01 - as does telnet. I'm pretty sure its not a problem from their end and like Tom said smoothwall isn't going to block outbound ports by default.

[tickmike]

telnet can be a useful debugging tool in this sort of situation to check connectivity to the Citrix service on port 1494.

from your come machine try:

 telnet school.county.sch.uk 1494 

if you get something along the lines of connected to ..... then you know that its an application error and nothing to do with your smoothie

 

Not sure if there are different versions of telnet ( I use W2K ) but I found out I had to put "open" in front of the school ip eg

open (school ip address) 1494

Then it WORKED I could Telnet through my smooth box to port 1494.

 

OK but what does this prove ?.

[tickmike]

I have sent the schools ICT manager a link to this post and said about there citrix software needs updating.

 

It's not fair to say that they NEED to upgrade... .

 

What I mean is can you just do an free update (like you update windows or your anti virus) .

you can tell I know nothing about Citrix products.! :oops:

[tickmike]

SmoothWall Express shouldn't block anything outgoing by default... drop me a line if you're still getting problems.

 

tom

 

 

Sent you a PM.

[CyberNerd]

Not sure if there are different versions of telnet ( I use W2K ) but I found out I had to put "open" in front of the school ip eg

open (school ip address) 1494

Then it WORKED I could Telnet through my smooth box to port 1494.

 

OK but what does this prove ?.

 

 

It proves that you have a connection to the server on port 1494, therefore no ports are being blocked on the way, and no routing problems. probably this is a problem with your citrix client application, and not smoothwall.