Secure Global Desktop 4.31 Administration Guide > Security > Using Secure Global Desktop with the HTTPS port through a firewall

Using Secure Global Desktop with the HTTPS port through a firewall

Problem

Your firewall only allows web access from the Internet via port 443. You need Secure Global Desktop to use this port as well.

Solution

Reconfigure Secure Global Desktop to listen on port 443. Then use the Firewall Forwarding facility to allow Secure Global Desktop to forward any traffic not related to Secure Global Desktop to your web server.

Case study

Indigo Insurance, has their firewall configured to only allow HTTPS access (on port 443) from the Internet. They do not want to open any additional ports so their array of Secure Global Desktop servers must use the same port as well.

Solution

In Array Manager, select Array and click the Properties button.
Change Port Numbers, Encrypted connections from 5307 to 443.
For each Secure Global Desktop server in the array, use tarantella config list --array-port-encrypted to check that the change to the port number has taken effect.
Reconfigure each web server in the array to listen on localhost port 443. For the Secure Global Desktop Web Server, edit the <IfDefine SSL> section in the httpd.conf file and change Listen 443 to Listen 127.0.0.1:443.
For each Secure Global Desktop server in the array, select Security properties and set Firewall Forwarding URL to https://127.0.0.1:443. (Alternatively, type tarantella config edit --security-firewallurl https://127.0.0.1:443 from a command line.)
If you are using the browser-based webtop or you have developed your own web applications, you must also secure the SOAP connections to a Secure Global Desktop server.
Restart each Secure Global Desktop Web Server in the array, tarantella webserver restart --ssl.
Restart each Secure Global Desktop server in the array, tarantella restart command.

Next steps

You may need some additional configuration if you are using Secure Global Desktop with proxy servers.

Related topics
How can I support users with a client-side firewall that only allows connections on the HTTPS port? Securing the SOAP connections to a Secure Global Desktop server Security properties (server-specific) The tarantella security start command The tarantella security stop command