Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installed Tomcat7 in a PRD machine that has Windows Server 2008 R2 Enterprise and is already running IIS 7.5 with some .NET sites bound on port 80. I need to deploy an e-commerce web application from which I expect a high number of user interactions. The application is written in JSF+Spring, so it seems that the only static content is the images and css.

We have only 1 NIC and 5 IP addresses associated with the machine.

  • Can anyone tell me if it is a good choice to make the application available outside my machine directly through Tomcat (performance, vulnerability oriented)?

  • Will I have a benefit or a penalty using Tomcat behind IIS? And why?

Port 80 is busy as a result of IIS so one of the benefits I see from using IIS is that it can parse the incoming HTTP requests and, based on domain name, send the proper traffic to Tomcat.

For example, www.tomcatapp.com is redirected from IIS to ip:8080 where Tomcat is listening too. Using only Tomcat, I would have to ping the application by using the full URL:port binding: www.tomcatapp.com:8080

I have found several discussion regard this topic but noone was conclusive.

share|improve this question
    
Are you saying that using the high port for Tomcat's listener doesn't fit your needs - or just that you need to configure IIS to redirect to the high port? –  Shane Madden Feb 13 '12 at 22:23
    
My needs are to reach my site/application only typing www.tomcatapp.com outside my machine (already have a domain that point to my IP). For my scenario I can not do this because port 80 is busy from IIS. The only way I can handle this (from my knowledges) is to make a binding of my domain in IIS that redirect the calls to Tomcat, but before I take this approach I needed to know what kind of penalties or benefits I have. –  Ermal Feb 13 '12 at 23:41
add comment

1 Answer 1

up vote 2 down vote accepted

The downside of redirecting up to port 8080 is that you're redirecting up to port 8080. Your users will see it in their address bar, which looks kinda unprofessional; additionally, some corporate firewalls and web filters will block access to port 8080, so that may be an issue too depending on your clientele.

If you can dedicate one of your IPs (or if it's this way already) to the Tomcat web app, then you can actually get IIS to stop binding that port:

netsh http add iplisten 192.0.2.1
netsh http add iplisten 192.0.2.2
netsh http show iplisten

Where 192.0.2.1 and 192.0.2.2 are the addresses you want IIS to bind to port 80 on. Once that's done, restart the IIS service. See here for reference.

This will free up port 80 on the IP address that you want to have Tomcat bind to, allowing you to listen with it directly.

share|improve this answer
    
Thanks for the answer Shane! You solved a mystery which I am dealing from days:-) Now I have Tomcat directly accessible on port 80. Do you think is plausible leaving Tomcat as web server, and not fronting with a real web server as IIS or Apache? (performance, vulnerability oriented) –  Ermal Feb 14 '12 at 1:30
    
Yeah, it should be no problem. The cases where you would not want it to be the direct web server would be either when you need to do load balancing between multiple Tomcat nodes, or when you need a web application firewall type of security layer (like Apache's mod_security). Aside from those cases, directly exposing Tomcat should be just fine. –  Shane Madden Feb 14 '12 at 1:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.