Connect to remote JMX over ssh and jconsole

ssh -N -f -D 7777 dev-cass-10.mydomain.internal

jconsole -J-DsocksProxyHost=localhost -J-DsocksProxyPort=7777 service:jmx:rmi:///jndi/rmi://localhost:7199/jmxrmi

EC2 server to VPC private instance via VPC NAT instance

1. iptables -t nat -A PREROUTING -s 23.23.23.23/32 -d 10.0.0.254/32 -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 3306 -j DNAT --to-destination 10.0.12.10:3306
1. 23.23.23.23 is your external server's public IP address
2. 10.0.0.254 is your VPC NAT instance's IP address in the public subnet
3. 10.0.12.10 is the VPC IP address of your server in a private subnet
4. 3306 is the port your service is listening on

keytool: put your SSL key into a new keystore

1. openssl pkcs12 -export -in mycert.crt -inkey mykey.key -out myp12blob.p12 -name mykeystorealias -CAfile mycascert.crt
1. Set the password to "changeit"
2. keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore mykeystore -srckeystore myp12blob.p12 -srcstoretype PKCS12 -srcstorepass changeit -alias myalias
3. keytool -list -v -keystore mykeystore

Taken: https://confluence.atlassian.com/display/DOC/Running+Confluence+Over+SSL+or+HTTPS

JMX ports to open in firewall for jconsole to Cassandra

1. Port 7199
1. Used for about a dozen packets when JMX connection first made
1. A handshake of sorts
2. Probably sets up the agreement on which high port to connect to, used below
1. Similar to SIP
2. Similar to old FTP
2. Not used again after initial handshake
2. Port range 55000 to 55999
1. To see these packets, on JVM server
1. tcpdump -nn ! port 22 and host <jconsole client IP> (not literal, replace this)
3. If jconsole starts showing graphs, you are connected

To run jconsole directly on the server via VNC, see this article: http://sysadminandnetworking.blogspot.com/

Tricks and Tips

1. If you don't want to expose 1000 ports to the world for some reason
1. Open all ports on firewall in front of JVM server
2. On JVM server: tcpdump -nn ! port 22 and host <jconsole client IP>
3. Start jconsole connection on client machine
4. Watch to see which port JVM server is trying to reach jconsole client via
5. Close all but that port in the firewall, will be between 55000-55999
2. Do a local experiment to a local JVM JMX-able application if unsure of good jconsole connection result
3. Get your external IP from where you are running jconsole client
1. CLI: curl http://ipaddr.me
2. Or web browser: http://ipaddr.me