Can't Access Tomcat Running on Linux over the Network?

[Andrew Remington]

I am attempting to communicate with my Tomcat 8.0 server running on GNU/Linux, specifically, Debian Jessie (8.0).

sudo ifconfig shows that my wlan0 address is 192.168.254.103, I am attempting to connect to my laptop from my Android on the same wireless network.

However, accessing 192.168.254.103:8080 from the Android tells me that the address is unreachable.

As far as I can tell, I have the Tomcat server configured correctly. I can access it fine via 127.0.0.1:8080 with all of the default apps etc.

I can also access it from the server computer using its local network address, 192.168.254.103:8080/.

But I cannot access it from another computer over the same network, and am not sure of the reason why.

I have the default configuration for an HTTP Connector in my server.xml:
<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" />

There are no address attributes in the Connector element, so it should be binding to all available addresses.

Here is also the results of sudo netstat -lntup relevant to port 8080:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 11863/java

Here is the output from sudo iptables -L -n -v..which shows me nothing as far as I know.

Chain INPUT (policy ACCEPT 184K packets, 21M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 313K packets, 251M bytes)
pkts bytes target prot opt in out source destination

Initially, Tomcat seemed to be binding to port 8080 via IPV6 and not IPV4 (which is somewhat confusing in itself), but I managed to get it to correctly bind to port 8080 on IPV4 by setting the JAVA OPTS shell variable to

"$JAVA_OPTS -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses".

So even though this was solved, I still am not quite sure what I am doing wrong.

Anyone have any helpful ideas?

[Tim Holloway]

Some versions of the Java JDK do use IPV6 instead of IPV4 as the default networking option and have to be overridden. You can avoid having to manually set the JAVA_OPTS each time by creating a "setenv.sh" in the TOMCAT_HOME/bin directory and putting your environment assignment statement in that file.

By default, Linux has a tight firewall. Check your iptables and open up tcp port 8080 in order to allow external clients to access Tomcat.

[Karthik Shiraly]

Also check the gateways and routes on your server, other computers on network and android.
They should all have the same gateway, route to 192.168.x.y via that gateway and that route should have the lowest metric if there are multiple gateways.

[Andrew Remington]

Yes, I'm aware that a firewall could potentially be the problem.. However the iptables rules are completely empty and are all set to "ACCEPT", which as far as I know, should guarantee that the iptables firewall isn't restricting anything.

I'm not a pro at iptables so I installed the ufw and gufw packages, which are the "uncomplicated firewall" software that are supposed to manage iptables for me. I've set the thing to off. Still nothing.

The router's security settings are disabled as well.. everything including settings that aren't likely to even be related to ip address and packet blocking.

I can ping the entire network from my computer and find everything.. but nowhere on the network, outside of the router's routing table, can I find my server.. which leaves me scratching my head. I'm not sure where I'm getting this wrong.

[Ron McLeod]

Is the Android device on the same subnet as the Linux platform hosting Tomcat? If not, and it there is a NATing router in the path, make sure that you have port forwarding for the particular port to route to the Linux platform, or maybe set the Linux platform as the DMZ device.

Also, many home routers use TCP port 8080 on their WAN side for administrative access. Even if you have this feature turned-off, it still may be stealing the port 8080 traffic.

[Andrew Remington]

All devices at home share the same subnet mask and default gateway. I've tried even accessing from another Windows computer.

I've reconfigured the Tomcat HTTP Connector port to 5000. Still no luck.

EDIT: Interestingly enough, tethering my server to my phone's wifi actuallly allows me access to Tomcat through the phone. Not sure what to make of this.

[Tim Holloway]

Does "netstat -ln" on the Tomcat server list the port as being listened to?

[Andrew Remington]

Yes. The results of netstat -lnp (I added the p option to show the program) gives me the following info with regards to port 5000:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN      6885/java

[Ron McLeod]

You might want to run a network sniffer such as tcpdump or tshark on the Linux platform to see if it provides you any clues. For example, below you can see the three-way handshake between the client (169.254.1.200) and the server (169.254.1.1) to establish the TCP connection, followed by a HTTP request and response.

# tshark -i any -l -s 0 -nn port 8080
Capturing on Pseudo-device that captures on all interfaces
  0.000000 169.254.1.200 -> 169.254.1.1 TCP 68 11769 > 8080 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=4 SACK_PERM=1
  0.000105 169.254.1.1 -> 169.254.1.200 TCP 68 8080 > 11769 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=256
  0.000576 169.254.1.200 -> 169.254.1.1 TCP 62 11769 > 8080 [ACK] Seq=1 Ack=1 Win=65700 Len=0
  0.001077 169.254.1.200 -> 169.254.1.1 HTTP 346 GET / HTTP/1.1
  0.001188 169.254.1.1 -> 169.254.1.200 TCP 56 8080 > 11769 [ACK] Seq=1 Ack=291 Win=15872 Len=0
  0.042696 169.254.1.1 -> 169.254.1.200 HTTP 221 HTTP/1.1 301 Moved Permanently

[Tim Holloway]

Try "ping 192.168.254.103". If that fails, you may have a cable problem.

[Andrew Remington]

The Wireshark suggestion was exactly what I needed to dig deeper, and I've found some interesting things:

If I ping -from- the server towards another computer on the network, the computer that was pinged to will temporarily be able to ping back and access the apps on Tomcat!

and if I wait five minutes, and then try to ping the server/access tomcat, it can no longer find the host!

Running Wireshark shows that I'm not even getting any ARP packets on the server, which would explain the difficulties in connection - it can't reply to an ARP that it doesn't even see.

I doubt that it's a problem with the router because I'm able to ARP just fine from the server, it's just the inward ARPs that are the problem.

I'm convinced now it has to be some kind of driver issue related to this very similar problem.

[Tim Holloway]

In short, it appears that you have a dud network interface card.

[Andrew Remington]

Problem appears to have been fixed after I uninstalled the `network-manager` package.

I think there was some conflict with the `wicd` package. I have no clue why this happened, and I've wasted almost a week of my life trying to fix this problem.

So.. I guess you could say I'm happy. I even learned a thing or five about networking while trying to resolve the issue.

Thank you for your help everyone.

[Karthik Shiraly]