I have a simple static website (foo.com) served with Apache2. The static website has a link to get to an application served using tomcat. To do so, the link just points to foo.com:8080/app

The end goal is to avoid having the port number. I also want to avoid using mod_proxy or mod_jk because the two contents (the static pages and app) are fairly unrelated, so I think it would be an overkill. The common use case is static page->app [never come back]

Here are some options I have considered:

  1. Run the app on a different machine, and map its IP to a subdomain (s1.foo.com). Then on this machine, use iptables to forward the 80 port to 8080, so that s1.foo.com/app works as expected.

  2. Get an additional IP address for the one server. Have a subdomain point to that IP address, then use iptables to forward IP:8080 to IP:80.

My questions are 1) Are these sensible? 2) What steps should I follow so that I don't mess up my rule chains? 3) Are there better alternatives?

Thank you,


Your best option is to get a second IP for the server, set it up as an IP alias. The first IP is set on network interface eth0, the next one on eth0:0 (a third would be eth0:1, and so on).

Here's a general guide, but it might be easier to look for recent instructions for your Linux distro specifically:


Once you've done that, you set Apache up to bind to the first IP (as it is now) and Tomcat to bind to the new IP, e.g.

eth0   - - Apache
eth0:0 - - Tomcat

Then set your DNS up something like:

example.org        -
tomcat.example.org -

No need to use :8080 at all, or any redirection/IP Tables forwarding. The links just point to http://tomcat.example.org/whatever/

Note that it is a new network interface, so you will want to check your IPTables rules and:

a) Close port 8080 on your first interface when you are no longer using it

b) Make sure you check / set IPTables to lock down the new IP address so only port 80 is allowed in.

  • Thank you for your detailed answer. The only problem is this would require me to bind tomcat to port 80, hence with root privileges, which I read at several places is a security no-no. – Elmasto Oct 16 '10 at 17:58
  • Oh good grief, I didn't even consider a modern server wouldn't be able lock itself down like Apache does, but it looks like Java/Tomcat can't. Yes, that is a security no-no. – TessellatingHeckler Oct 18 '10 at 4:21

Assume Linux? Just configure a virtual network interface and have Tomcat listen on said interface. DNS map as you see fit.

  • I still need to do port redirection, no? I don't want to have the :8080, regardless of the dns mapping. Thank you – Elmasto Oct 15 '10 at 21:25
  • @Elmasto: I think you could just configure Tomcat to use port 80 on the virtual interface, thus no messy port redirections are needed. – Steven Monday Oct 15 '10 at 22:52
  • Correct, TCP/UDP ports are assinged per interface. Make a virtual interface atop your eth0 and you can assign the process to listen to 80 on said interface. – Jé Queue Oct 16 '10 at 1:06
  • You'll need to be sure that apache and tomcat are configured to listen on specifically one IP address, eg NameVirtualHost can't use \*:80 and you must specify a Listen xx.xx.xx.xx:80 in Apache so it only listens on one IP – DerfK Oct 16 '10 at 1:25
  • What do ya'all think about binding tomcat to port 80? I keep reading that is not generally advisable (since tomcat will need to run as root). – Elmasto Oct 16 '10 at 18:02

Serve both the static and the webapp using tomcat listening in port 80? If you don't need Apache flexibility, running both servers doesn't always make sense.

  • I could do that, but that would require me running tomcat as root (assuming the performance reflections of serving static pages off tomcat can be ignored for my low number of visitors) – Elmasto Oct 16 '10 at 18:01
  • Use jsvc or iptables. Performance is not that bad serving static. It has been measured. klawitter.de/tomcat80.html#jsvc – rubiojr Oct 17 '10 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.