The memoQ server in a Corporate

Network
Version 3.5

LSP Guide

memoQ copyright 2004-2009 Kilgray Translation Technologies. All rights reserved.

Contents

Overview .................................................................................................................................................................2

Possible Network Setups..................................................................................................................................3

IP Addresses ..........................................................................................................................................................5

The Client Connect Address Problem..........................................................................................................5

Resolving the Client Connect Address Problem......................................................................................7

The memoQ server in a Corporate Network LSP Guide

Overview

Language service providers (LSPs) usually work with mixed teams consisting of internal staff
and external contractors, or freelancers. When a translation task requires a team with multiple
translators and/or reviewers, it is natural to use a translation memory server or a translation
project server such as the memoQ server.
If a team includes both internal staff and freelancers, the same server needs to be accessible both
from the LSPs internal network and from the Internet. This might present difficulties for the LSP
because the same server might be visible at one specific address for the internal network, and
another address from the Internet.
This might be a problem for the memoQ server because it exposes one and only one client connect address. This address is included in the server project details: when a translator or a reviewer is checking out a server project, the memoQ desktop program will look for the published
translation memories and termbases using this client connect address. However, if the server
physically resides in the company network, client computers need to use a different address
depending on whether they are inside the network, or accessing it from the Internet. Since you
cannot specify two or more client connect addresses in memoQ server, this might cause an issue
in the network setup.
This document describes the problem in a non-technical manner and outlines the possible solutions. It is important to note that the issue is not directly related to the configuration of memoQ
server rather, it concerns the overall network setup of the company.

The memoQ server in a Corporate Network LSP Guide

Possible Network Setups

An organization has two options when it comes to placing their public servers. Smaller organizations prefer to put up their servers outside the company network, in a hosting center of an ISP
(Internet Service Provider). In this setup, the organization itself accesses the server over the
Internet, so the server has one address indeed. This means that hosted servers do not expose the
problem outlined above, so this setup will not be considered further on.
The second option is used by larger organizations that have a proper company network with a
suitable broadband Internet connection. Such organizations place (some of) the public servers
within the company network, retaining full control over the data and configuration on the server
(as opposed to hosted servers).
An organization usually protects its network from online attacks using firewalls. A firewall is a
dedicated computer with a piece of software that monitors incoming traffic (data), and detects
potential threats. It can also be used to control access to one part of the network or another, or
to control/restrict the Internet access for internal computers or users.
If an organization has no servers in its internal network, the firewall usually blocks all incoming
traffic (data). This means that no connection can be initiated from the outside. This is just like a
phone that can be used to make calls but cannot be called. If the connection is initiated from the
inside for example, a user accesses a web page or downloads her e-mails the firewall will of
course let in the reply to the request.

Give me that
webpage!
Give me that
webpage!

Give me that
External computer
webpage!
Figure 1: A simple small business network with no servers and a fully blocking firewall

The memoQ server in a Corporate Network LSP Guide

If there is a server in the network, however, the setup becomes more complicated. Similarly to
an airlock, the companynetwork will be split into two parts, and will have at least two security
doors that is, firewalls. Between the two firewalls there is a so-called de-militarized zone, or
DMZ. If a memoQ server is hosted within a company network, it is most likely to be put in a DMZ.
There will be an inner part containing client computers that cannot be accessed from the outside. This will have the same full protection as the network in Figure 1 an inside door or firewall blocking all incoming requests. The secure middle part contains the servers that make some
of their services public. However, these servers will also be protected by a firewall from the outside because the company wants to retain total control and protection of the data stored on
them. Just like the outer door of an airlock, the firewall protecting the servers will be opened up
very carefully, making sure that nothing is exposed that does not explicitly need to be exposed.
This means that it will have somewhat permissive settings so that the services published by the
servers are accessible from the Internet.
The servers placed in the DMZ are accessed from two networks: from the internal network and
from the Internet.

Internal network:
Client computers

Internal
firewall

DMZ:
Server

External
firewall

Internet

The memoQ server in a Corporate Network LSP Guide

IP Addresses

The rules that govern how computers talk to each other on a network is called the TCP/IP protocol suite. One of the rules is that each computer must have at least one address consisting of four
numbers such as 81.116.212.59 or 192.168.0.49. These addresses are called the IP addresses.
Different networks have different address ranges. The Internet is in fact made up from an enormous amount of networks (so it is a network of networks) having different address ranges.
There are special address ranges that are considered as private. If a computer has a private address, it cannot be directly accessed from the Internet. Such addresses start with the numbers
192.168, 172.16, or 10. This means that a computer with the address 192.168.0.26 is not accessible from the Internet, whereas one with the address 81.92.178.3 is.
Different networks can be connected to each other using a device called the router. The Internet
contains an enormous amount of interconnected routers, this is why any two computers on the
Internet can actually talk to each other, regardless of the network they are in. Private networks
are also hooked up to the Internet using a router that usually also acts as a firewall.
The internal network of a company tends to be a private network. Most likely they have an address range like 192.168.1.101192.168.1.223 or similar. These addresses are not accessible
from the Internet. When this network is hooked up to the Internet, it will receive one public IP
address that is accessible from the outside. This means that from the Internet, the entire private
network will look like a single computer having a public IP address such as 86.176.45.9. The
router will take care of distributing the incoming data among the internal computers.
If a private network contains a server such as the memoQ server, it will be accessible through
two IP addresses: one private address, and one public address (that will probably be the single
public address the network has).

Range of IP addresses:

IP address of the server:

192.168.1.101192.168.1.223

86.176.45.9. (public address)

192.168.2.11 (private address)

Funnily enough, the single external address of a private network can never be accessed from
within the private network itself. This is to prevent circular traffic or direct feedback, which
would mean a blowup of the amount of data transferred over the network, and would cause the
network to stop functioning.

The memoQ server in a Corporate Network LSP Guide

The Client Connect Address Problem

The memoQ server can have exactly one address where client computers can connect to it (client connect address). If the server that runs the memoQ server software has two IP addresses,
only one of those can be used to contact the server. In this setup, the following problems may
happen:
(1) If the client connect address is set to the internal IP address of the server, only the internal
users can check out server projects from the server. External users will not be able to check
out server projects.
(2) If the client connect address is set to the external IP address of the server, only the external
users can check out server projects from the server. This will not work for the internal users.
If a mobile user brings her laptop into the internal network, she will not be able to access the
same server projects that worked fine earlier.
In all other respects, the server can be accessed both internally and externally because the client
connect address is not used when the users access translation memories or term bases on the
server without a server project.

The memoQ server in a Corporate Network LSP Guide

Resolving the Client Connect Address Problem

The client connect address problem goes away if you can use one single name or address for the
server, and this name is equally valid in both the internal and external networks. We already
know that this is not possible by using IP addresses.
The problem can be solved by using DNS names instead of IP addresses. A DNS name or fully
qualified domain name, FQDN is a friendly name for a computer that can be used in lieu of an
IP address. For example, there is a computer with the IP address 195.56.44.105. This IP address
is not known to many people because this computer is almost always accessed by the name
www.kilgray.com.
When you type the www.kilgray.com address into your browser, your computer will contact
another server called the DNS (Domain Name System) server. This server is operated by your
internet service provider (ISP). Its task is to find the IP address for names like this. In finding the
IP address, the ISPs DNS server co-operates with other DNS servers on the Internet.
By the clever use of DNS servers, it is possible to assign the same name (like www.kilgray.com)
to multiple IP addresses. This means that the server should be accessible by the name memoqserver.lspname.com both from the internal and the external computers.
Lets suppose there is a memoQ server in the internal network with

an internal IP address of 192.168.2.11, and

an external IP address of 81.195.46.7

The memoQ servers client connect address is set to memoqserver.lspname.com. This setup
works if

the internal computers, when accessing memoqserver.lspname.com are directed to

192.168.2.11 (the internal IP address), and

the external computers, when accessing the same domain name, are directed to 81.195.46.7.

This means that the DNS servers should say different addresses to the internal and the external
computers. There are two possible solutions to this:
1. Setting up an internal DNS server. This is the way to go if the internal network uses Active
Directory. If you use Active Directory, at least one server in your organization should work as a
DNS server anyway.
You can create a zone for your lspname.com domain on the internal DNS server, and instruct it
to return the internal IP address of the memoQ server when queried. All other DNS queries
(such as web page requests) should be forwarded to the external DNS server usually run by your
ISP. The internal DNS server can do this easily.
The internal computers and laptops brought in must be directed to the internal DNS server, but
that is easily done through automatic IP configuration (present in almost every network).

The memoQ server in a Corporate Network LSP Guide

This document does not contain detailed configuration instructions on setting this up since it
depends on the type of the DNS server you are using. It also depends on the type of the device
that distributes the IP addresses within the network. The latter can be a router/firewall or a
separate computer (running mostly Linux or Windows) with DNS server software. Your IT staff
must be able to set this up.
2. Using the HOSTS file. This approach is useful if you have no internal DNS server. Your internal
computers use the external DNS server run by the internet service provider. However, there is a
file in their system directory that needs to be modified. In Windows, the HOSTS file is in the following folder:
C:\Windows\System32\drivers\etc

It looks like this:

#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#

Copyright (c) 1993-2006 Microsoft Corp.

This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
This file contains the mappings of IP addresses to host names. Each
entry should be kept on an individual line. The IP address should
be placed in the first column followed by the corresponding host name.
The IP address and the host name should be separated by at least one
space.
Additionally, comments (such as these) may be inserted on individual
lines or following the machine name denoted by a '#' symbol.
For example:
102.54.94.97
38.25.63.10

127.0.0.1
::1

rhino.acme.com
x.acme.com

# source server
# x client host

localhost
localhost

You need to add one line here:

<internal_address_of_memoQ_server>

memoqserver.lspname.com

Using the numbers from the previous example:

192.168.2.11

memoqserver.lspname.com

This file contains exceptions to general DNS rules. The system supposes that every IP address
should be queried from the external DNS server but these.
You need to make this change on the internal computers. This way the DNS server will return
the external IP address of the memoQ server, but the internal computers will not use it. Instead,
they will contact the memoQ server using the internal address because of this extra line in the
HOSTS file.
Note that the second approach will not work with laptops unless the HOSTS file is modified each
time the laptop is brought in and taken out.