WCF net.tcp over internet without changing firewall settings?

Question

I have a Client and a Host application. The Client can send messages and gets callback messages back.

I use this code to create the duplex channel on the client side:

proxy = DuplexChannelFactory<IMonitor>.CreateChannel(new InstanceContext(this), new NetTcpBinding(SecurityMode.None), new EndpointAddress(endpoint));

On the Host application I self-host the service:

using (ServiceHost host = new ServiceHost(typeof(MonitorImpl.Monitor), new Uri(uri)))
{
    host.Open();
    Console.WriteLine("Service is hosted, has the following endpoints.");
    host.Description.Endpoints.ToList().ForEach(end => Console.WriteLine(end.Address));

    return Console.ReadLine();
}

As you may have noticed I have a Project named: MonitorImpl that contains the class Monitor. This class contains the code of the methods I use to call the service and the callback methods.

This program works locally and if I open the port on the computer hosting the host application, it also works on 2 different computers (in the same network).

My question is: How can I make this work on 2 different computers (over the internet) without having to change things to the firewall at the computer which is hosting the application? Am I going to need to change to type of binding to something else and if so... to what? Do I need to change the way or place I create the duplex channel? Anything else?

Answer 1

No matter which binding you use, duplex or not, or even whether you are even hosting a WCF service or any other kind of application that listens on a TCP or UDP socket: You always have to make sure that the host's firewall accepts incoming connections on the port that the service listens to. Any sane firewall configuration blocks incoming connections by default.

The only way to get around this is to tunnel over a VPN or some kind of proxy service for which the firewall already has an open port.

Answer 2

You can use the duplex bindings to prevent needing to open ports on the CLIENT. Your host will still need to be exposed for the client to initiate the communications. You need to have something open on one end so the other can call it to start the process