Service access client behind firewall?

[agnivohneb]

I am about to make a program that will involve sending commands via android phone to a server (to route the commands) then send that info off to the right client behind a firewall. There are two way I can think of doing this 1. is to tell the person using the client to open a port for the server to send the commands to it. I think that is not very easy for some users to do or not practical (ie. cannot access the firewall to change settings manually). 2. Have the program ping the server every so often and download any new information if available. The problem with this method is if I set the ping too frequently then bandwidth is mindlessly being used up (especially if you don't send a command for days) and if the ping is spread too far apart then the commands could come late of when they were needed (ie. 30min-1hr late).

So how do some of these programs like instant messengers do it? Can someone tell me? Brownies for a sudo tutorial

[rdrake]

They establish a link between the client and server via a socket and can communicate back and forth that way. Of course this means your server will have to maintain a connection to all clients at all times.

[md]

You could also use one of the many NAT-busting techniques and use UDP. Only works if the "firewall" is really just a NAT though, if your using a real firewall then all bets are off (then it depends on configuration). Using a technique like this doesn't really cut down on traffic though as you need to keep your connection alive or the NAT will drop it.

A TCP connection with a ping packet every minute or so tends to be really light on bandwidth, and gets around the NAT/Firewall issue as long as the client initiates the connection. Then when there is data to send you just send it over the already estabished connection. This does require a constant connection for every client but is how many IM programs work.

[Dan]

It is possible to use UPnP (https://en.wikipedia.org/wiki/Universal_Plug_and_Play) to add port mappings from the clinet program automaticly if the firewall/router supports it and has it enabled.

If this is some kind of remote controll for a computer it may be best to respect the NAT/firewall and force users to set up rules as there could be big security issues if outside connections get access to the application.