Hosting Behind a Firewall with Service Bus
Updated: June 18, 2014
This topic describes several ways to connect to Microsoft Azure Service Bus from behind a firewall or through a proxy server.
The following troubleshooting topics discuss common solutions to problems encountered when you connect through a firewall to Service Bus.
To use the Service Bus relay, ensure that your firewall allows outgoing TCP communication on TCP ports 9350 to 9354. For Service Bus brokered messaging, use port 9354. For AMQP, use port 5672. To use WebStreams over HTTPS, you must allow outbound HTTPS connections to port 443.
If you are running behind a firewall/proxy that requires authentication, or if you are running in an IPsec-protected network, there are additional obstacles for any client to reach the network proxy. For example, Windows accounts might not have permissions to communicate through the firewall. Therefore, you might have to explicitly configure the WinHTTP proxy settings with the appropriate credentials.
Setting the connectivity mode to HTTP (that is,
ConnectivityMode = http) may cause connections in the presence of some proxies to be very slow. For example, some connections can require up to 20 seconds to connect. Extending the OpenTimeout option for the service to up to two minutes can help, because you might run out of time between the acquisition of the Access Control token and getting the Web stream working. After the Web stream is established, the throughput often improves.