Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a requirement to run a Java based web server on port 80. The options are:

  • Web proxy (apache, nginx, haproxy etc.)
  • xinet
  • iptables
  • setuid

The baseline would be running the app using setuid but I'd prefer not to for security reasons. Apache is too slow and nginx doesn't support keep-alives so new connections are made for every proxied request.

xinet is easy to set up but creates a new process for every request which I've seen cause problems in a high performance environment.

The last option is port forwarding with iptables but I have no experience of how fast it is.

Of course, the ideal solution would be to do this on a dedicated hardware firewall / load balancer but that's not an option at present.

At the moment, the setup is all on the same box which is why iptables should work.

Load is as follows approximately 2500 very short lived http requests per second that need to have a maximum latency of 50ms with... say at least 25 milliseconds for the app to return a response.

share|improve this question
    
haproxy is the answer, oh yes it is –  user44384 Aug 26 '10 at 10:57
add comment

4 Answers

up vote 1 down vote accepted

Can you describe your setup? I don't quite understand if everything resides on one server or if you have a separate gateway and web servers.

But yes, HAproxy indeed. Best suited for balancing to more than one web servers. I use it for http and smtp balance.

share|improve this answer
    
Hiya, have added some more info. Does HAproxy use keepalives back to the app that it is proxying? –  user44384 Jun 2 '10 at 21:12
add comment

I wouldn't be 100% if iptables performance will be faster than other solutions. Any rule in iptables chains will be mached agains all the trafic while userland proxy will be triggered on ly on new connections.

My advise: Test and benchmark it.

share|improve this answer
add comment

Other options maybe pound or haproxy

share|improve this answer
add comment

iptables works within the kernel itself which means that it will be much faster than delegating to a userland proxy.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.