1

I am trying to set up a JBoss app server on an RHEL build. Jboss is bound to 127.0.0.1:8080, and I am trying to setup iptables to redirect all traffic from port 80 to port 8080. This is my config file:

:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 127.0.0.1:8080
-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443
-A OUTPUT  -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:8080
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A FORWARD -i eth0 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8080 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

But no matter what, the output of iptables -L -v -n is revealing all traffic is getting rejected. If I turn off iptables, it works, but I'd like to use it. Thanks.

This is the output:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  165 10948 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
   12   576 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
 3237  405K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            127.0.0.1           state NEW tcp dpt:8080
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 146 packets, 19249 bytes)
 pkts bytes target     prot opt in     out     source               destination
  • ESTABLISHED in --state NEW,ESTABLISHED is redundant. That's already covered by your first INPUT rule. Also port 8443 doesn't appear to be allowed. As for the problem at hand, though, it would help if you could provide some diagnostic output. "all traffic is getting rejected"... really, all? Please try to be as specific as possible. That helps helpers to help you :) – sysconfig Dec 11 '14 at 18:14
  • What's this ? Why are you trying to DNAT from the "outside" to a non routable IP ? It definately can't work ... – Xavier Lucas Dec 11 '14 at 21:41
3

I would say this is wrong approach. In any case, I wouldn't want to have JBoss (nor tomcat) to manage direct connections other then for test purpose. It's not designed to manage directly outside connections.

Option 1 Have apache web server proxy to 127.0.0.1:8080

You need this somewhere in your apache setup

LoadModule proxy_module  {path-to-modules}/mod_proxy.so
AddModule  mod_proxy.c

Or with apache2

$ sudo a2enmod proxy
$ sudo apache2ctl restart

And in virtual hosts you could have several apps

ProxyPass         /myapp  http://localhost:8080/myapp
ProxyPassReverse  /myapp  http://localhost:8080/myapp

or have a unique one

ProxyPass         /  http://localhost:8080/
ProxyPassReverse  /  http://localhost:8080/

after changing virtual hosts setting, no need to restart apache

$ sudo apache2ctl graceful

will update settings without dropping ongoing connections.

Option 2, using mod_ajp

$ sudo a2enmod proxy_ajp
$ sudo apache2ctl restart

adding this to your virtualhost

ProxyPass /app ajp://backend.example.com:8009/app

Assuming tomcat instance is configured to have ajp connector on port 8009. Check tomcat settings.

http://httpd.apache.org/docs/2.2/mod/mod_proxy_ajp.html

Option 3, using mod_jk http://tomcat.apache.org/connectors-doc/

You'll still have the other issue that is to configure JBoss as to create links to :80, that will be a JBoss setting problem... can't remember where it's set, all I can remember is that it took me a while to find out. I've preferred using the ajp connector so far.

Sorry, I don't have have access to a JBoss setup right now, perhaps someone can point us where is that setting.

  • "In any case, I wouldn't want to have JBoss (nor tomcat) to manage direct connections other then for test purpose. It's not designed to manage directly outside connections." Can you qualify that? I don't see why pure proxying (without caching or load balancing) would be more suitable than having it talk directly to clients. – sysconfig Dec 11 '14 at 18:10
  • It's to do with how is managed each connection. Even without load balancing, having a proxy makes a difference in managing different connections to different clients versus having to manage a limited number of connections, leaving apache web server deal with things like keepalive. Using a web server will also allow some fine tuning on some headers like cache management of the client. – Antony Gibbs Dec 13 '14 at 6:15
  • Using apache web server as proxy will allow a better load management. Using mpm worker (not prefork) will use less ram. It can also allow having multiple apps running from the same virtual host, and could also ease things the day you would like it to be in https. Trust me, not only technically it works better under heavy load but also it bring you all the tools that come with a web server. Tomcat isn't a web server. – Antony Gibbs Dec 13 '14 at 6:23
  • An other goody a web server brings, is the DEFLATE/gz on the fly, but also all the graphing tools like munin that will help monitor incoming connections. I couldn't tell you precisely why tomcat doesn't behave so well when managing multiple clients. I suspect it only manages one connection at a time. Apache mpm prefork would allocate a process for each active client while mpm worker will use a separate thread (up to a maximum of 64 of thread per process). I don't know how this is dealt with tomcat, I'm just guessing it just puts incoming connections in queues. – Antony Gibbs Dec 13 '14 at 6:44
  • 1
    I ended up using Apache instread of iptables, it made life easier. – Delmania Dec 15 '14 at 21:29
1

if you dont want or cant use a reverse proxy to expose JBoss in port 80 a posible configuration to using Port Forwarding with JBoss is:

/sbin/iptables -t nat -A OUTPUT     --destination localhost   -p tcp --dport 80 -j REDIRECT --to-ports 8080
/sbin/iptables -t nat -A OUTPUT     --destination <network IP address> -p tcp --dport 80 -j REDIRECT --to-ports 8080
/sbin/iptables -t nat -A PREROUTING --destination <network IP address> -p tcp --dport 80 -j REDIRECT --to-ports 8080

/sbin/iptables -t nat -A OUTPUT     --destination localhost   -p tcp --dport 443 -j REDIRECT --to-ports 8443
/sbin/iptables -t nat -A OUTPUT     --destination <network IP address> -p tcp --dport 443 -j REDIRECT --to-ports 8443
/sbin/iptables -t nat -A PREROUTING --destination <network IP address> -p tcp --dport 443 -j REDIRECT --to-ports 8443

/sbin/iptables --flush PREROUTING -t nat
/sbin/iptables --flush OUTPUT -t nat

Also you can do JBoss listen directly on port 80.

See: Running JBoss on Port 80 or 443 or Set Listening port to 80 in jboss AS 7.1

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.