Listeners
Intro
Installation
SysAdmin
Network 
Listener
Dialup 
Objects
Transfer
RealTime
Access
Services
Directory
Clusters
Applications
WebMail
PBX
Miscellaneous
Licensing

The CommuniGate Pro Server accepts SMTP, IMAP, POP, LDAP, and other TCP/IP connections using Listeners. A Listener opens one or several listener sockets, each socket accepting TCP/IP connections directed to the specified port number and, optionally, to the specified local IP address.

The Listener settings allow the Server administrator to specify the type of connections to accept (regular, clear text connections or secure connections), and the optional remote address restrictions - that grant access to the listener sockets only to the computers inside the specified networks.

CommuniGate Pro TCP Listeners can limit the number of incoming connections that come from the same IP address. This can help to prevent some of the Denial of Service (DoS) attacks.

CommuniGate Pro Server can accept SNMP, RADIUS, SIP, and other UDP connection-less requests using UDP Listeners. A UDP Listener opens one UDP listener socket and receives UDP packets on the specified port number and, optionally, on the specified local IP address. The UDP Listeners support address restrictions.

Multi-Socket Listening

TCP/IP services use Listeners to accept incoming connections. Each Listener can use one or several listener sockets. A listener socket accepts incoming TCP connections on the TCP port number you specify. You should also specify if the socket should accept connections on all IP addresses your server computer has, or only on a selected address.

For example, you may want to create a socket that accepts all connections on one local IP address, while the other socket is used to accept connections on the other local IP address - and only from the specified networks.

Because of the nature of TCP sockets, you cannot have two listener sockets that use the same port number and the same local IP address: if you create a listener socket on the TCP port N that works with ALL local IP addresses, you cannot create a different socket on the same port N. If you create a listener socket on the TCP port N and a specific local address xx.yy.zz.tt, then you can create a different listener socket on the same TCP port N and a different local address xx.yy.zz.tt.

If your CommuniGate Pro server coexists with some other server software, such as a third-party Web server, you may want to configure that Web server to use one local IP address, while your CommuniGate Pro server would provide its HTTP services on a different local IP address - but on the same port number. If that port number is 80, and the domain name www.company.com resolves into the first IP address, while mail.company.com resolves into the second IP address, then typing http://www.company.com in a client browser will bring up the third-party Web Server home page, while typing http://mail.company.com will bring up the CommuniGate Pro Login page - with both servers running on the same server computer.

Port Local Address Init SSL/TLS Remote Address Restrictions

To create a new listener socket, change the value in the last table element from 0 to the desired TCP port number and click the Update button.

To remove a listener socket, change its port number to 0 and click the Update button.

Even if your server has only one IP address, you may want to create two listener sockets for most of your services: one for regular, clear text connections and one (on a different port number) for secure connections (see below).

Secure Sockets

Set the Init SSL/TLS listener socket option to On to tell the Listener component to initiate SSL/TLS negotiations as soon as a connection from a remote site is accepted. Only when a secure connection is established, the Listener allows the communication module to initiate its own protocol (IMAP, HTTP, etc.) - on top of the secure SSL/TLS protocol.

Note: Please read the Security section and configure your Domain TLS certificates before you set this option to On.

Note: When a Listener accepts a connection on a Secure Socket, it tries to detect the CommuniGate Pro Domain the client has connected to. At this time no information has yet been transferred from the client to the server, so the local server IP address the client has connected to is the only data CommuniGate Pro can use to detect the target Domain.
If you want a Domain to have its own Security Certificate and to use it for Secure Socket connections, that Domain must have an IP address assigned to it.

When the Domain is selected, the Listener retrieves the Domain Certificate and initiates a secure (SSL/TLS) session. If the selected Domain does not have a Certificate, the connection is dropped and an error message is placed into the CommuniGate Pro Log.

Note: The current versions of the Internet protocols support the STARTTLS/STLS or equivalent commands. These commands are used to provide secure communications without creating a special Secure Socket on an additional port. Instead, a regular port is used, and a regular, non-secure connection is established, and then the client sends the STARTTLS or an equivalent command, and the client and server initiate the SSL/TLS session. If the software you use employs the STARTTLS command (as most SMTP software packages do these days), then you do not need to create any special Secure Socket for secure (SSL/TLS) communications.

Set the Init SSL/TLS listener socket option to Ext to tell the Listener component that all connections coming to this socket are SSL/TLS secured, but that there is an external device implementing all SSL/TLS encryption/decryption operations.
Connections coming to these ports are clear-text connections, but higher-level CommuniGate Pro components and protocols process these connections as if the came encrypted: clear-text Login operations are considered secure, STARTTLS operations are prohibited, etc.

Restrictions

You may want a listener socket to accept connections only from the certain remote network (IP) addresses.

If you set the Restriction setting to Grant, and list the IP addresses in the text field, the socket will accept connections from the specified addresses only.

If you set the Restriction setting to Deny, and list the IP addresses in the text field, the socket will deny access to all clients trying to connect from the specified (blacklisted) addresses.

The IP addresses are specified in a multi-line format. See the System Administrator section for more details.

There is a difference between the Access Restrictions on the listener socket level, and the restrictions set in the SMTP module. When a remote site connects to your server SMTP port and the site IP address is not accepted by the listener socket, the connection is closed immediately. As a result, the remote site will try all other IP addresses of your server, and then it will try to relay mail via your back-up server.

On the other hand, if the remote site address is included into the Server Protection Black-List, SMTP sessions are not closed immediately. Instead, the SMTP session starts and the remote (blacklisted) server is allowed to send the addresses of message recipients. But the SMTP module rejects each address with a "fatal error" code, thus stopping the blacklisted host from trying to relay those messages via your back-up servers.

There is a difference between the Access Restrictions on the listener socket level, and the restrictions set by the Grant Access to the Clients Only option. When a remote site connects to your Server POP, IMAP, WebUser, or other access-type port and the site IP address is not accepted by the listener socket, the connection is closed immediately. As a result, the remote site may try all other IP addresses of your server (and you may have different access restrictions on listener sockets serving those addresses).

On the other hand, if the remote site address is not included into the Server Client IP Addresses list, sessions are not closed immediately. Instead, an access-type session starts, and, if the Grant Access to Clients Only option is enabled, an error message is sent to the remote site before the module closes the connection.

Limiting Connections from the same Address

To prevent various Denial of Service (DoS) attacks you may want to limit the number of connections a Listener can accept (on all sockets) from the same IP address:
Limit Connections from same Address: Reserve Connections for Clients:

When you set this settings, you should remember that:

Note: to avoid problems with inter-server communication, this setting has no effect on connections that come from other servers in the same CommuniGate Pro Cluster.

Reserving Connections for Client Addresses

To prevent various Denial of Service (DoS) attacks you may want to set aside a certain number of available connections for those who connect to your Server from Client IP Addresses.

If the difference between the maximum number of allowed connections and the number of active connections is equal to or smaller than the specified Reserve value, connections from non-Client IP Addresses are rejected.

UDP Listeners

UDP services use UDP Listeners to accept incoming packets (connection-less requests). Each UDP Listener uses a UDP listener socket. A UDP listener socket accepts incoming UDP packets on the UDP port number you specify. You should also specify if the socket should accept packets on all IP addresses your server computer has, or only on a selected address.

Because of the nature of UDP sockets, you cannot have two UDP listener sockets that use the same UDP port number and the same local IP address: if you create a listener socket on the UDP port N that works with ALL local IP addresses, you cannot create a different socket on the same port N. If you create a listener socket on the UDP port N and a specific local address xx.yy.zz.tt, then you can create a different listener socket on the same UDP port N and a different local address xx.yy.zz.tt.

The UDP Listener WebAdmin pages allow you to configure UDP Listeners:

Port Local Address Remote Address Restrictions

All UDP Listener settings have the same meaning as the TCP Listener settings (see above).

CommuniGate® Pro Guide. Copyright © 1998-2006, Stalker Software, Inc.