Routers, Firewalls and multilayer servers
We only have one IP address at Well House Manor
, but lots of computers. How does that work?
Internally, all our machines are on 192.168.200.xxx network but the router re-writes those to our single IP address on output, and for traffic where the client is at our place (that's most traffic such as web browsers and FTP clients) it remembers who has opened which particular connection so that replies can be written back correctly.
Accesses to any servers that we run locally are slightly more problematic; incoming traffic of a particular type can only be routed to one machine ... and indeed we have one machine set up as the default destination for all types of traffic / ports (this machine is known as a DMZ or demilitarised zone) and care needs to be taken of the security on it. Then we make exceptions - the diagram showing how all traffic on TCP port 80 (web service) is routed to our web server, and traffic for printing is routed to a printer.
By using a single instance of httpd, fronting a number of machines running Tomcat, you can have a single web server that's targeted for all traffic that then distributes it to other services. This distribution is done by httpd via mod_proxy_balancer, mod_rewrite or mod_jk (and there are some other historic ways too).
As well as allowing traffic to be sent to a single machine, this approach also means that the main servers - running Tomcat - can be hidden behind a firewall and the high level of protection only need be applied to the httpd machine.
One of the issues of splitting traffic between a number of back end servers is that you have to make sure that sessions are continued properly - it's no good having a user start his work on machine "X" then get transferred to machine "Y" if machine "Y" isn't even aware of what he has done on "X".
There are a number of solutions to this issue, including the inclusion of a cookie in the initial response to instruct the user's browser to ask for the same machine next time (we do this in real life - "I was talking to Mavis about it ... can you put me through to her again please"). This diagram shows another approach - how the parallel machines can all co-ordinate via another machine behind them - perhaps running a database such as MySQL, or perhaps even another instance of Tomcat. (written 2009-05-01, updated 2009-05-02)
Associated topics are indexed underA052 - Web Application Deployment - Networking - General 
TCP v UDP / Client v Server - Python examples - (2010-03-25) 
Routing Network Traffic - Proxies, Redirects and DNS - (2009-05-01) 
Our new .eu top level domain - (2006-06-19)
Some other Articles
Bean Classes in Java and Java Database ConnectionsClass Loading and Variable Conversion in JavaMy four feet!What is a JSP tag library?Routers, Firewalls and multilayer serversVariable scope in Java Servlets and other web applicationsA very easy JSP (Java Server Page)An evening excursion to Devizes and AveburyUsing the internet to remotely check for power failure at home (PHP)
4088 posts, page by page
Link to page ... 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82 at 50 posts per page
This is a page archived from The Horse's Mouth at
the diary and writings of Graham Ellis.
Every attempt was made to provide current information at the time the
page was written, but things do move forward in our business - new software
releases, price changes, new techniques. Please check back via
our main site for current courses,
prices, versions, etc - any mention of a price in "The Horse's Mouth"
cannot be taken as an offer to supply at that price.
Link to Ezine home page (for reading).
Link to Blogging home page (to add comments).