Installation and Administration

Firewall Consideration

Updated: July 17, 2023

Firewalls don't like inactive connections that stay open. Most of them will drop the connection silently, which will generate errors on connections pools like database, AJP or LDAP. Here is some advice to prevent this.

Firewall Between Apache and the Nuxeo Platform in AJP Mode

If you are using mod_proxy_ajp, you can activate a TCP keep alive to prevent persistent connections from being dropped. This requires the usage of mod_proxy options keepalive=on and flushpackets=on. You also need to configure the TCP keep alive delay using sysctl (net.ipv4.TCP_keepalive_time).

Refer to mod_proxy documentation for more information.

Firewall Between the Nuxeo Platform and the Database

Database pool can try to reconnect on invalid connection (NXP-7528) but it is better to enable the keep alive on your database. For instance using PostgreSQL, this can be achieved with the following options:

5Maximum number of TCP keepalive retransmits.
60Time between issuing TCP keepalives.
60Time between TCP keepalive retransmits.

Firewall Between the Nuxeo Platform and LDAP

Here, there are no keep alive alternative. You can simply disable the LDAP connection pool in the directory configuration.