Problems accessing Jira from Public Internet

[David Livelsberger]

We recently configured Jira to allow access to the application via the public Internet.

When users access Jira internally, the application works fine with no errors.

However, when users try to access Jira from the public Internet, the login page is rendered; however most of the time, users can't login. Jira returns bad password. If they are able to login, none of the dropdowns work and they can't navigate thru the application.

That same person can then connect to our network using our VPN and Jira is working fine. Same results for employees working from our office.

Our Jira server resides behind our private firewall with IP address 10.197.177.230.

Our Apache web server resides in our DMZ with IP address 10.197.191.230.

Jira users accessing the application while connected to the VPN or physically in the office are connecting to Jira via the Apache webserer IP address of 10.197.177.230. DNS for jira.c-e.com points to 10.197.177.230.

External users connect to Jira via a public IP address 170.78.24.230 which is then NAT'd to the Apache webserver private IP address of 10.197.177.230.

Ports 80 and 443 are open between 170.78.24.230 and 10.197.177.230.

I believe the Apache virtual host is configured correctly since Jira works correctly when users are on a VPN or in the office. 

The difference between the internal and external users is the public facing firewall.

What am I missing? Should there be additional ports open on the public facing firewall? If not, can anybody provide me some thoughts on how I troubleshoot this issue>

Thank you in advance for your help. I look forward to hear from you.

[Joe Pitt]

Something is probably happening at the public firewall. I suggest you engage your network team. As long as your server is in the DMZ and can talk to the database behind the firewall you shouldn't need any other ports.

[David Livelsberger]

Joe,

To clarify, the Apache web server resides in the DMZ while the Jira application server sits behind the firewall.

I agree that there is something missing in the firewall. The Jira application server runs on port 8090. (http://<server host name>:8090

On the Apache server virtual host, we have configured the following proxy redirects:

        ProxyPass               /       http://<server host name>:8090/
        ProxyPassReverse        /      http://<server host name>:8090/

When I run nmap -n <URL> from the Internet, the command returns that ports 80 and 443 are open but ports 8080 and 8090 are closed?

Do I need to tell the network team to open ports 8080 and 8090 between the public IP address and the NAT'd DMZ IP address?

[Joe Pitt]

It certainly sounds like you need to have 8090 open