You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@tomcat.apache.org by Dieter Schicker <di...@uni-graz.at> on 2007/10/02 17:38:03 UTC

tomcat iptables problem

Hi,

this is my first mail to this list so please forgive me if it's the
wrong list.
Here's my problem:

I'm running tomcat 5.5.23 on Debian Etch (4.0) with Linux kernel
2.6.18-4-xen-amd6.
Now I set up an iptables firewall (with fwbuilder) with the following
open ports:
8080 (http), 8005 (shutdown?), 8009 (ajp connector) and all lo traffic
is allowed.
With this configuration I have the following behavior: Tomcat needs 3
minutes to shut down and another 3 minutes to start up again. If it runs
it runs perfectly ...

Any ideas?

Cheers
Dieter


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem

Posted by albrecht andrzejewski <al...@ema.fr>.

Quoting Dieter Schicker <di...@uni-graz.at>:

> With this configuration I have the following behavior: Tomcat needs 3
> minutes to shut down and another 3 minutes to start up again. If it runs
> it runs perfectly ...
>
> Any ideas?

It can occurs if you are working with a localhost" url... If you do,  
just check your tomcat log
If you had this error:
java.net.UnknownHostException: localhost
then take a look to you /etc/hosts to declare it properly !

but you have to know you would obtain a better help if you provide  
your tomcat log...


----------------------------------------------------
Ce message a ete envoye par le serveur IMP de l'EMA.



---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem

Posted by Pid <p...@pidster.com>.

Dieter Schicker wrote:
> Hi,
> 
> this is my first mail to this list so please forgive me if it's the
> wrong list.
> Here's my problem:
> 
> I'm running tomcat 5.5.23 on Debian Etch (4.0) with Linux kernel
> 2.6.18-4-xen-amd6.
> Now I set up an iptables firewall (with fwbuilder) with the following
> open ports:
> 8080 (http), 8005 (shutdown?), 8009 (ajp connector) and all lo traffic
> is allowed.

shutdown port only listens on localhost/127.0.0.1 so you don't need to
firewall it.

> With this configuration I have the following behavior: Tomcat needs 3
> minutes to shut down and another 3 minutes to start up again. If it runs
> it runs perfectly ...

there is a recent thread in the archives regarding a slow shutdown, you
may wish to search and look as I remember it was resolved.


p


> Any ideas?
> 
> Cheers
> Dieter
> 
> 
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
> 
> 


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem

Posted by Dieter Schicker <di...@uni-graz.at>.

Sorry, of course the "accept bla bla" goes into a separate line!

Dieter Schicker wrote:
> Thanks a lot for all your valuable answers! Unfortunately none of them 
> helped me.
> Let me give you an example of this strange behavior (tomcat starting 
> very slowly [>3min.]).
>
> iptables Ruleset:
>
> -----------------------------------------------------
> Chain INPUT (policy DROP)
> target     prot opt source               destination
> accept bla bla
> accept bla bla
>
> Chain FORWARD (policy DROP)
> target     prot opt source               destination        accept bla 
> bla
> accept bla bla
>
> Chain OUTPUT (policy DROP)
> target     prot opt source               destination    accept bla bla
> accept bla bla
> -----------------------------------------------------
>
> => Tomcat starts slowly.
>
> Then I do the following:
>
> iptables -P INPUT ACCEPT
> iptables -P OUTPUT ACCEPT
> iptables -P FORWARD ACCEPT
> iptables -F INPUT
> iptables -F OUTPUT
> iptables -F FORWARD
>
> So I get:
>
> -----------------------------------------------------
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination       
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination       
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> -----------------------------------------------------
>
> => Tomcat still (!!!) starts slowly! (Why???)
>
> Only when I restart the whole Debian machine and do not start the 
> firewall tomcat starts fast.
>
> The system is Debian 4.0 with a 2.6.18-4-xen-amd64 kernel and
> apache-tomcat-5.5.23 (same behavior with apache-tomcat-6.0.14).
>
> Any suggestions?
>
> Many thanks in advance
> Dieter
>
>
>
>
>
> Christopher Schultz wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Dieter,
>>
>> Dieter Schicker wrote:
>>  
>>> Now I set up an iptables firewall (with fwbuilder) with the following
>>> open ports:
>>> 8080 (http), 8005 (shutdown?), 8009 (ajp connector) and all lo traffic
>>> is allowed.
>>>     
>>
>> What about outgoing allowed ports?
>>
>>  
>>> With this configuration I have the following behavior: Tomcat needs 3
>>> minutes to shut down and another 3 minutes to start up again. If it 
>>> runs
>>> it runs perfectly ...
>>>     
>>
>> I'm not sure about shutdown, but if your server (or application) is
>> configured to use, say, an XML document with a SYSTEM ID that points to
>> an outside URL (for instance: http://java.sun.com/dtd/web-app_2_3.dtd),
>> the XML parser might be attempting to access that URL. If your firewall
>> is preventing outgoing HTTP connections (good old port 80), it might
>> waste a lot of time re-trying before it finally gives up and reads
>> non-validated XML).
>>
>> I would change your iptables configuration to set all outgoing rejected
>> requests to LOG as well as reject, and then you can watch the iptables
>> log (usually the "kernel" log on Debian IIRC) for requests to foreign
>> hosts on port 80.
>>
>> Hope that helps,
>> - -chris
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.7 (MingW32)
>> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>>
>> iD8DBQFHAsQE9CaO5/Lv0PARAkrSAKCa6D0xMiG6zo4SdP5r3FVbEN30+ACgonNN
>> UuRz6pB8z+UUciozFLGv3eY=
>> =N69G
>> -----END PGP SIGNATURE-----
>>
>> ---------------------------------------------------------------------
>> To start a new topic, e-mail: users@tomcat.apache.org
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>   
>
>
> Dieter Schicker
> INIG - Department of Information Processing in the Humanities
> Karl Franzens University of Graz
> Merangasse 70
> A-8020 Graz
> Tel.: +43 316 380 8012
> http://www-gewi.uni-graz.at/inig/


Dieter Schicker
INIG - Department of Information Processing in the Humanities
Karl Franzens University of Graz
Merangasse 70
A-8020 Graz
Tel.: +43 316 380 8012
http://www-gewi.uni-graz.at/inig/
-- 
Student of Computer Science
Graz University of Technology
schicker@student.tugraz.at


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem - problem kinda solved

Posted by Dieter Schicker <di...@uni-graz.at>.

Hi,

just in case someone has the same problem. It's obviously a problem with 
the fwbuilder software. I know used firehol to build the rules and 
everything works fine.
>
> What about doing "/etc/init.d/iptables stop" when the firewall is
> running. Does Tomcat then start and stop more quickly?
>   
/etc/init.d/iptables doesn't seem to exist anymore in Debian Etch. It 
seems every "firewall (builder)" has its own start/stop script.

> I find it hard to believe that the presence of the iptables kernel
> module is causing this problem. "/etc/init.d/iptables stop" should set
> all the rules to "allow everything", while the same command with "start"
> should load the rules you have configured for the host. See if that does
> anything.
>   
Perfectly right, it has nothing to do with the presence of the iptables 
kernel module.
> The important thing is that there /are/ times when it starts up quickly.
> That's good, because that means it's possible ;)
>   
Hehe, good one! ;-)

Thanks again for your help
Dieter
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFHA6li9CaO5/Lv0PARAidYAJ0Q0znqi2xu02uZ6uwatD1kZBmYgQCfQTMF
> IqX42e199hyP7v4RF330Jxw=
> =7VuT
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>   


Dieter Schicker
INIG - Department of Information Processing in the Humanities
Karl Franzens University of Graz
Merangasse 70
A-8020 Graz
Tel.: +43 316 380 8012
http://www-gewi.uni-graz.at/inig/
-- 
Student of Computer Science
Graz University of Technology
schicker@student.tugraz.at


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem

Posted by Christopher Schultz <ch...@christopherschultz.net>.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dieter,

Dieter Schicker wrote:
> [all chains set to drop unless otherwise configured]
> => Tomcat starts slowly.

:(

> Then I do the following:
> 
> [all chains set to accept, all chains empty]
>
> => Tomcat still (!!!) starts slowly! (Why???)

:(

> Only when I restart the whole Debian machine and do not start the
> firewall tomcat starts fast.

What about doing "/etc/init.d/iptables stop" when the firewall is
running. Does Tomcat then start and stop more quickly?

I find it hard to believe that the presence of the iptables kernel
module is causing this problem. "/etc/init.d/iptables stop" should set
all the rules to "allow everything", while the same command with "start"
should load the rules you have configured for the host. See if that does
anything.

The important thing is that there /are/ times when it starts up quickly.
That's good, because that means it's possible ;)

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHA6li9CaO5/Lv0PARAidYAJ0Q0znqi2xu02uZ6uwatD1kZBmYgQCfQTMF
IqX42e199hyP7v4RF330Jxw=
=7VuT
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem

Posted by Dieter Schicker <di...@uni-graz.at>.

Thanks a lot for all your valuable answers! Unfortunately none of them 
helped me.
Let me give you an example of this strange behavior (tomcat starting 
very slowly [>3min.]).

iptables Ruleset:

-----------------------------------------------------
Chain INPUT (policy DROP)
target     prot opt source               destination
accept bla bla
accept bla bla

Chain FORWARD (policy DROP)
target     prot opt source               destination        
accept bla bla
accept bla bla

Chain OUTPUT (policy DROP)
target     prot opt source               destination    
accept bla bla
accept bla bla
-----------------------------------------------------

=> Tomcat starts slowly.

Then I do the following:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

So I get:

-----------------------------------------------------
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
-----------------------------------------------------

=> Tomcat still (!!!) starts slowly! (Why???)

Only when I restart the whole Debian machine and do not start the 
firewall tomcat starts fast.

The system is Debian 4.0 with a 2.6.18-4-xen-amd64 kernel and
apache-tomcat-5.5.23 (same behavior with apache-tomcat-6.0.14).

Any suggestions?

Many thanks in advance
Dieter





Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dieter,
>
> Dieter Schicker wrote:
>   
>> Now I set up an iptables firewall (with fwbuilder) with the following
>> open ports:
>> 8080 (http), 8005 (shutdown?), 8009 (ajp connector) and all lo traffic
>> is allowed.
>>     
>
> What about outgoing allowed ports?
>
>   
>> With this configuration I have the following behavior: Tomcat needs 3
>> minutes to shut down and another 3 minutes to start up again. If it runs
>> it runs perfectly ...
>>     
>
> I'm not sure about shutdown, but if your server (or application) is
> configured to use, say, an XML document with a SYSTEM ID that points to
> an outside URL (for instance: http://java.sun.com/dtd/web-app_2_3.dtd),
> the XML parser might be attempting to access that URL. If your firewall
> is preventing outgoing HTTP connections (good old port 80), it might
> waste a lot of time re-trying before it finally gives up and reads
> non-validated XML).
>
> I would change your iptables configuration to set all outgoing rejected
> requests to LOG as well as reject, and then you can watch the iptables
> log (usually the "kernel" log on Debian IIRC) for requests to foreign
> hosts on port 80.
>
> Hope that helps,
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFHAsQE9CaO5/Lv0PARAkrSAKCa6D0xMiG6zo4SdP5r3FVbEN30+ACgonNN
> UuRz6pB8z+UUciozFLGv3eY=
> =N69G
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>   


Dieter Schicker
INIG - Department of Information Processing in the Humanities
Karl Franzens University of Graz
Merangasse 70
A-8020 Graz
Tel.: +43 316 380 8012
http://www-gewi.uni-graz.at/inig/
-- 
Student of Computer Science
Graz University of Technology
schicker@student.tugraz.at


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat iptables problem

Posted by Christopher Schultz <ch...@christopherschultz.net>.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dieter,

Dieter Schicker wrote:
> Now I set up an iptables firewall (with fwbuilder) with the following
> open ports:
> 8080 (http), 8005 (shutdown?), 8009 (ajp connector) and all lo traffic
> is allowed.

What about outgoing allowed ports?

> With this configuration I have the following behavior: Tomcat needs 3
> minutes to shut down and another 3 minutes to start up again. If it runs
> it runs perfectly ...

I'm not sure about shutdown, but if your server (or application) is
configured to use, say, an XML document with a SYSTEM ID that points to
an outside URL (for instance: http://java.sun.com/dtd/web-app_2_3.dtd),
the XML parser might be attempting to access that URL. If your firewall
is preventing outgoing HTTP connections (good old port 80), it might
waste a lot of time re-trying before it finally gives up and reads
non-validated XML).

I would change your iptables configuration to set all outgoing rejected
requests to LOG as well as reject, and then you can watch the iptables
log (usually the "kernel" log on Debian IIRC) for requests to foreign
hosts on port 80.

Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHAsQE9CaO5/Lv0PARAkrSAKCa6D0xMiG6zo4SdP5r3FVbEN30+ACgonNN
UuRz6pB8z+UUciozFLGv3eY=
=N69G
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org