X-Git-Url: http://winboard.nl/cgi-bin?a=blobdiff_plain;f=manual%2Fhtml_node%2FFirewalls.html;h=a2ad9838b61188085b84867a37c1d51fccc27123;hb=6ef5a4594dc90cfd66cc24f806241eaaaa2eebe6;hp=611a02c9b6a42eb4ed4b60a1c15c41b84b0673ee;hpb=64c29c63bf9bc30906c1f20a590f18d0874545e3;p=xboard.git diff --git a/manual/html_node/Firewalls.html b/manual/html_node/Firewalls.html index 611a02c..a2ad983 100644 --- a/manual/html_node/Firewalls.html +++ b/manual/html_node/Firewalls.html @@ -33,124 +33,131 @@ Up: Top

5 Firewalls

-

By default, XBoard communicates with an Internet Chess Server -by opening a TCP socket directly from the machine it is running on -to the ICS. If there is a firewall between your machine and the ICS, -this won't work. Here are some recipes for getting around common -kinds of firewalls using special options to XBoard. -Important: See the paragraph in the below about extra echoes, in -Limitations. - -

Suppose that you can't telnet directly to ICS, but you can telnet -to a firewall host, log in, and then telnet from there to ICS. -Let's say the firewall is called ‘firewall.example.com’. Set -command-line options as follows: - -

     xboard -ics -icshost firewall.example.com -icsport 23
+

By default, XBoard communicates with an Internet Chess Server +by opening a TCP socket directly from the machine it is running on +to the ICS. If there is a firewall between your machine and the ICS, +this won't work. Here are some recipes for getting around common +kinds of firewalls using special options to XBoard. +Important: See the paragraph in the below about extra echoes, in +Limitations. + +Suppose that you can't telnet directly to ICS, but you can telnet +to a firewall host, log in, and then telnet from there to ICS. +Let's say the firewall is called ‘firewall.example.com’. Set +command-line options as follows: + +

     xboard -ics -icshost firewall.example.com -icsport 23
 
-

Or in your .Xresources file: - -

     XBoard*internetChessServerHost: firewall.example.com
-     XBoard*internetChessServerPort: 23
+   

Or in your .Xresources file: + +

     XBoard*internetChessServerHost: firewall.example.com
+     XBoard*internetChessServerPort: 23
 
-

Then when you run XBoard in ICS mode, you will be prompted -to log in to the firewall host. This works because port 23 is the -standard telnet login service. Do so, then telnet to ICS, using a -command like ‘telnet chessclub.com 5000’, or whatever command -the firewall provides for telnetting to port 5000. - -

If your firewall lets you telnet (or rlogin) to remote hosts but -doesn't let you telnet to port 5000, you may be able to connect to the -chess server on port 23 instead, which is the port the telnet program -uses by default. Some chess servers support this (including -chessclub.com and freechess.org), while some do not. - -

If your chess server does not allow connections on port 23 and your -firewall does not allow you to connect to other ports, you may be able -to connect by hopping through another host outside the firewall that -you have an account on. For instance, suppose you have a shell -account at ‘foo.edu’. Follow the recipe above, but instead of -typing ‘telnet chessclub.com 5000’ to the firewall, type -‘telnet foo.edu’ (or ‘rlogin foo.edu’), log in there, and -then type ‘telnet chessclub.com 5000’. - -

Suppose that you can't telnet directly to ICS, but you can use rsh -to run programs on a firewall host, and that host can telnet to ICS. -Let's say the firewall is called ‘rsh.example.com’. Set -command-line options as follows: - -

     xboard -ics -gateway rsh.example.com -icshost chessclub.com
+   

Then when you run XBoard in ICS mode, you will be prompted +to log in to the firewall host. This works because port 23 is the +standard telnet login service. Do so, then telnet to ICS, using a +command like ‘telnet chessclub.com 5000’, or whatever command +the firewall provides for telnetting to port 5000. + +If your firewall lets you telnet (or rlogin) to remote hosts but +doesn't let you telnet to port 5000, you may be able to connect to the +chess server on port 23 instead, which is the port the telnet program +uses by default. Some chess servers support this (including +chessclub.com and freechess.org), while some do not. + +If your chess server does not allow connections on port 23 and your +firewall does not allow you to connect to other ports, you may be able +to connect by hopping through another host outside the firewall that +you have an account on. For instance, suppose you have a shell +account at ‘foo.edu’. Follow the recipe above, but instead of +typing ‘telnet chessclub.com 5000’ to the firewall, type +‘telnet foo.edu’ (or ‘rlogin foo.edu’), log in there, and +then type ‘telnet chessclub.com 5000’. + +Suppose that you can't telnet directly to ICS, but you can use rsh +to run programs on a firewall host, and that host can telnet to ICS. +Let's say the firewall is called ‘rsh.example.com’. Set +command-line options as follows: + +

     xboard -ics -gateway rsh.example.com -icshost chessclub.com
 
-

Or in your .Xresources file: - -

     XBoard*gateway: rsh.example.com
-     XBoard*internetChessServerHost: chessclub.com
+   

+Or in your .Xresources file: + +

     XBoard*gateway: rsh.example.com
+     XBoard*internetChessServerHost: chessclub.com
 
-

Then when you run XBoard in ICS mode, it will connect to -the ICS by using rsh to run the command -‘telnet chessclub.com 5000’ on host ‘rsh.example.com’. - -

Suppose that you can telnet anywhere you want, but you have to -run a special program called ptelnet to do so. - -

First, we'll consider the easy case, in which -‘ptelnet chessclub.com 5000’ gets you to the chess server. -In this case set command line options as follows: - -

     xboard -ics -telnet -telnetProgram ptelnet
+   

+Then when you run XBoard in ICS mode, it will connect to +the ICS by using rsh to run the command +‘telnet chessclub.com 5000’ on host ‘rsh.example.com’. + +Suppose that you can telnet anywhere you want, but you have to +run a special program called ptelnet to do so. + +First, we'll consider the easy case, in which +‘ptelnet chessclub.com 5000’ gets you to the chess server. +In this case set command line options as follows: + +

     xboard -ics -telnet -telnetProgram ptelnet
 
-

Or in your .Xresources file: - -

     XBoard*useTelnet: true
-     XBoard*telnetProgram: ptelnet
+   

+Or in your .Xresources file: + +

     XBoard*useTelnet: true
+     XBoard*telnetProgram: ptelnet
 
-

Then when you run XBoard in ICS mode, it will issue the -command ‘ptelnet chessclub.com 5000’ to connect to the ICS. - -

Next, suppose that ‘ptelnet chessclub.com 5000’ doesn't work; -that is, your ptelnet program doesn't let you connect to -alternative ports. As noted above, your chess server may allow you to -connect on port 23 instead. In that case, just add the option -‘-icsport ""’ to the above command, or add -‘XBoard*internetChessServerPort:’ to your .Xresources file. -But if your chess server doesn't let you connect on port 23, you will have -to find some other host outside the firewall and hop through it. For -instance, suppose you have a shell account at ‘foo.edu’. Set -command line options as follows: - -

     xboard -ics -telnet -telnetProgram ptelnet -icshost foo.edu -icsport ""
+   

+Then when you run XBoard in ICS mode, it will issue the +command ‘ptelnet chessclub.com 5000’ to connect to the ICS. + +Next, suppose that ‘ptelnet chessclub.com 5000’ doesn't work; +that is, your ptelnet program doesn't let you connect to +alternative ports. As noted above, your chess server may allow you to +connect on port 23 instead. In that case, just add the option +‘-icsport ""’ to the above command, or add +‘XBoard*internetChessServerPort:’ to your .Xresources file. +But if your chess server doesn't let you connect on port 23, you will have +to find some other host outside the firewall and hop through it. For +instance, suppose you have a shell account at ‘foo.edu’. Set +command line options as follows: + +

     xboard -ics -telnet -telnetProgram ptelnet -icshost foo.edu -icsport ""
 
-

Or in your .Xresources file: - -

     XBoard*useTelnet: true
-     XBoard*telnetProgram: ptelnet
-     XBoard*internetChessServerHost: foo.edu
-     XBoard*internetChessServerPort:
+   

+Or in your .Xresources file: + +

     XBoard*useTelnet: true
+     XBoard*telnetProgram: ptelnet
+     XBoard*internetChessServerHost: foo.edu
+     XBoard*internetChessServerPort:
 
-

Then when you run XBoard in ICS mode, it will issue the -command ‘ptelnet foo.edu’ to connect to your account at -‘foo.edu’. Log in there, then type ‘telnet chessclub.com 5000’. - -

ICC timestamp and FICS timeseal do not work through some -firewalls. You can use them only if your firewall gives a clean TCP -connection with a full 8-bit wide path. If your firewall allows you -to get out only by running a special telnet program, you can't use -timestamp or timeseal across it. But if you have access to a -computer just outside your firewall, and you have much lower netlag -when talking to that computer than to the ICS, it might be worthwhile -running timestamp there. Follow the instructions above for hopping -through a host outside the firewall (foo.edu in the example), -but run timestamp or timeseal on that host instead of telnet. - -

Suppose that you have a SOCKS firewall that will give you a clean -8-bit wide TCP connection to the chess server, but only after you -authenticate yourself via the SOCKS protocol. In that case, you could -make a socksified version of XBoard and run that. If you are using -timestamp or timeseal, you will to socksify it, not XBoard; this may -be difficult seeing that ICC and FICS do not provide source code for -these programs. Socksification is beyond the scope of this document, -but see the SOCKS Web site at http://www.socks.permeo.com/. -If you are missing SOCKS, try http://www.funbureau.com/. +

+Then when you run XBoard in ICS mode, it will issue the +command ‘ptelnet foo.edu’ to connect to your account at +‘foo.edu’. Log in there, then type ‘telnet chessclub.com 5000’. + +ICC timestamp and FICS timeseal do not work through some +firewalls. You can use them only if your firewall gives a clean TCP +connection with a full 8-bit wide path. If your firewall allows you +to get out only by running a special telnet program, you can't use +timestamp or timeseal across it. But if you have access to a +computer just outside your firewall, and you have much lower netlag +when talking to that computer than to the ICS, it might be worthwhile +running timestamp there. Follow the instructions above for hopping +through a host outside the firewall (foo.edu in the example), +but run timestamp or timeseal on that host instead of telnet. + +Suppose that you have a SOCKS firewall that will give you a clean +8-bit wide TCP connection to the chess server, but only after you +authenticate yourself via the SOCKS protocol. In that case, you could +make a socksified version of XBoard and run that. If you are using +timestamp or timeseal, you will to socksify it, not XBoard; this may +be difficult seeing that ICC and FICS do not provide source code for +these programs. Socksification is beyond the scope of this document, +but see the SOCKS Web site at http://www.socks.permeo.com/. +If you are missing SOCKS, try http://www.funbureau.com/. +