HTTP tunneling is used to encapsulate other protocols within
the HTTP or HTTPS protocols. It is typically used to pass
protocols that would normally be blocked by a firewall
through the firewall in a controlled manner.

There are two types HTTP tunneling 
 1.HTTP to Port

 2.Http To CGI
 
  this concept is frequently used in RMI

http is a hyper text transfer protocol
it is used in web server to web client
it is a one kind of internet protocoils

This well-worn method is popular since it requires almost 
no setup, and works quite well in firewalled environments 
which permit you to handle HTTP through a proxy, but 
disallow regular outbound TCP connections. 
If Java RMI fails to make a normal (or SOCKS) connection to 
the intended server, and it notices that a HTTP proxy 
server is configured, it will attempt to tunnel Java RMI 
requests through that proxy server, one at a time. 

There are two forms of HTTP tunnelling, tried in order. The 
first is http-to-port; the second is http-to-cgi. 

In http-to-port tunneling, Java RMI attempts a HTTP POST 
request to a http: URL directed at the exact hostname and 
port number of the target server. The HTTP request contains 
a single Java RMI request. If the HTTP proxy accepts this 
URL, it will forward the POST request to the listening Java 
RMI server, which will recognize the request and unwrap it. 
The result of the call is wrapped in a HTTP reply, which is 
returned through the same proxy. 

Often, HTTP proxies will refuse to proxy requests to 
unusual port numbers. In this case, Java RMI will fall back 
to http-to-cgi tunneling. The Java RMI request is 
encapsulated in a HTTP POST request as before, but the 
request URL is of the form http://hostname:80/cgi-bin/java-
rmi.cgi?port=n (where hostname and n are the hostname and 
port number of the intended server). There must be a HTTP 
server listening on port 80 on the server host, which will 
run the java-rmi.cgi script (supplied with the JDK), which 
will in turn forward the request to a Java RMI server 
listening on port n. Java RMI can unwrap a HTTP-tunneled 
request without help from a http server, CGI script, or any 
other external entity. So, if the client's HTTP proxy can 
connect directly to the server's port, then you don't need 
a java-rmi.cgi script at all. 

To trigger the use of HTTP tunneling, the standard system 
property http.proxyHost must be set to the hostname of the 
local HTTP proxy. (There are reports that some Navigator 
versions do not set this property.) 

The major disadvantage of HTTP tunneling is that it does 
not permit inward calls or multiplexed connections. A 
secondary disadvantage is that the http-to-cgi method opens 
a dramatic security hole on the server side, since without 
modification it will redirect any incoming request to any 
port