jms external client

[Usman Ibrahim]

Hi

In my solution I have to host a JMS provider for accepting jms messages from external clients. I have planned to have the application server which hosts my application (ear) as the jms provider. Application server is behind the internal firewall and the requests to the appserver is through a httpserver. My question is, what is the best practice in the following?

1) should I open the port in firewall to accept the incoming messages
2) can I have http tunnelling to receive the JMS messages as HTTP request.

Which is more prone to security attacks?

Many thanks

Usman.