Working with Firewall Tunneling

Important:

Tunneling is not available for MS Windows OS.

Remote debugging is the process of creating a connection between two machines: For example, the machine on which the client (IDE) resides and the machine on which the Zend Server resides. When these machines are on the same local network or there are no security devices that limit remote connections, no additional action is required. However, if one or both of the machines are behind a firewall, the communication required to run the debug process is not allowed. To allow debugging and still maintain a secure environment, you need to use firewall tunneling.

After a firewall tunnel is created, instead of assigning more communication ports for the Debug / Profile Sessions with the remote server, all communication between your IDE and the remote server proceeds through the tunnel.

Note for Windows OS users:

Tunneling does not work when Zend Server is installed on a Windows-based server. However, you can perform remote debugging to a machine behind a firewall as long as the correct ports are open on both ends.

The tunnel communication port should be used in the following circumstances:

When debugging or profiling files on a remote server which is behind a firewall or other security device.

Establishing communication between Zend Studio and Zend Server when Zend Server is running on a remote server which is behind a firewall or other security device. The communication between Zend Studio and Zend Server facilitates the integration of Zend Server event reporting capabilities with Zend Studio’s editing, debugging and profiling features, and makes it more effective.

To set up a tunneling connection, several configuration settings must be defined, both in Zend Studio and on your server's debugger. This can be done through Zend Server , Zend Platform, Zend Core or your php.ini file.

Setting-up Tunneling in Zend Server

The following procedure describes how to define allowed hosts for firewall tunneling. Users define allowed hosts for firewall tunneling to create a list of IP addresses (of computers that run Zend Studio) that connect to Zend Server for debugging purposes, in situations when a firewall stands between the machines.

Before setting-up tunneling, verify that the IP of the machine running Zend Studio is set as an allowed host. See Setting Up Debugging for more information.

Note:

The following instructions define how to configure Zend Server's side for tunneling. Additional IDE configurations are required to complete the process.

To define denied hosts for debugging:

In the UI, go to Debugging | Debugger Settings.
In the Security section, configure the Denied Hosts list:
1. In the hyphen-separated fields, enter a valid IP address or enter a range by entering the beginning of an IP address and adding '0' instead of the rest of the number.
  To make sure you are using Wildcards (*) to specify a range of IPs select the pattern you want from the drop-down list.
2. Click Add.
Click Save.

The IP or range of IPs is not allowed to connect to the server to debug PHP code with your IDE.

Note:

Do not add the same IP address to both the Allowed and Denied host lists. Pay attention when you specify a range of IP addresses: If you deny a range of addresses that includes an IP that was specified in the Allowed hosts, the host is not allowed to create a debug session.