JMS client behind a firewall

I have following scenario: Messages containing commands have to be send to a consumer / client which is connected to the internet using consumer Internet connections. So this means that the system running开发者_C百科 the client is not directly accessible from the Internet. The command server is located on an Internet facing server.

As a reliable connection is needed I thought about using JMS queues. The command server would be hosting the messaging component and will offer the necessary queues. Here's my question. Does the client need to be accessible from the Internet, e.g. will it open ports which are used to push messages from the server to the client?

If that's the case, are there any other models which avoid this behavior? E.g. I can think of opening a long lasting HTTP connection from the client to the server which is used in case of messages being pushed (COMET). However, I would really like to keep the abstraction JMS provides.

As a plan B could you recommend any good alternatives?

Normally it's the client who sets up the connection with the server, so the client can be behind a firewall.

Should you need to reverse the direction or better protect your JMS server you could always set up a VPN style connection between the computer that's behind the firewall and the command server. OpenVPN is an example of a robust, easy to manage and secure option. Because you can control the direction in which the link is set up, and you protect the JMS traffic and the normally exposed JMS server port I think that may be a good solution.

What JMS product do you use?