Linux OS firewall (IPv4 packet filter rules) blocking http connection

Linux OS firewall (IPv4 packet filter rules) blocking http connection

In this article I just want to share small piece of solution which we have found after struggling a bit. In our lab environment we were having two virtual servers 1) vff-soa-vs01 and 2) vff-soa-vs02.  We have installed admin server on vff-soa-vs01 on higher port range e.g. 10001, and it was running successfully as it can be verified in adminserver.out log, via netstat commands and ps –ef | grep weblogic commands.

However, when we tries to access this admin server from other virtual server vff-soa-vs02 it never get access. Even from windows desktop machine it was not getting opened.

While connectivity from both virtual servers was perfectly working. The below facts were working fine

1)    Vff-soa-vs01 was getting pinged from vff-soa-vs02 server
2)    Vff-soa-vs02 server was able to do telnet to vff-soa-01 server on port 22
3)    Vff-soa-vs02 was not able to do telnet on port 10001on vff-soa01 machine.

4)    Admin server was running on vff-soa-vs01 without any problem which can be verified using netstat, ps commands and logs files.

5)    Admin server url was not getting accessible from browser –

After troubleshooting a bit we came across OS level firewall which get implemented using “iptables” command.

The easiest way to fix this problem to stop the ‘iptables’ service using below command, if you have already implemented firewall at web tire, application tier and database tire level.


“service iptables stop”

 

If you want iptables to stop permanently then use below command - 

chkconfig iptables off

Alternatively, you can add specific rule in iptables to allow your systems ip to communicate each other. For detailed information about iptables command and configuration look for other articles, the one suitable which

I have found below useful urls - 

http://www.thegeekstuff.com/2011/06/iptables-rules-examples/
http://ipset.netfilter.org/iptables.man.html

One we have stopped the iptables service then immediately admin console url start working.

I hope above information which is very concise but can help you to fix your access problem.

Stopping Auto retrying messages for BPEL Engine

BPEL engine does the auto retry of the failed message which is in undelivered state, BPEL engine store all the message which is coming to engine in DLV_MESSAGE table and if any of the message if not getting resolved, BPEL engine will be keep retrying to process those message up to some retries and then finally it marked as exhausted.

Administrator can stop BPEL engine not to retry undelivered message. Below are the steps which need to follow to do the configuration – 

Step1:  

Click on SOA Infrastructure>>SOA Administration>>BPEL Properties

Step2:

Click on “More BPEL Configuration properties”

Step3:

Click on properties “MaxRecoverAttemp”, in below snap another key properties “RecoveryConfig” also got highlighted which will be discuss later section of this document. 

 

Step4:

Change the default value ‘2’ to ‘0’ and click on apply button as highlighted. It’s done.  Now BPEL will not retry automatically any invoke or callback failed activity.

 

 

Apart from above changes another key configuration exists in BPEL engine which is related to “RecoveryConfig”. BPEL engine has provided the way to recover all the unresolved messages in DLV_message table. These messages types includes –  

• All invoke and callback messages that are unresolved
• All activities (for example, wait activities and OnAlarm branches of pick activities) that have an associated expiration date and are scheduled with the SOA Infrastructure to be rescheduled 
• All activities that are not complete over a provided threshold time 

In order to change the recovery configuration you need to select  “RecoveryConfig” option from BPEL properties, once you select that option below screen will be appear-

 

Change the value according to your requirement. For more details about these values please refer the  below link provide from Oracle which gives detailed info – 

http://docs.oracle.com/cd/E14571_01/relnotes.1111/e10133/soa.htm#RNLIN1052