NGINX + Kamailio + FreeSwitch
Hello guys I want configure user frendly WebRTC server based on FreeSwitch and SipML5 client. It can be easy done in FreeSwitch and NGINX is bounded to different IP/ports. But if you wants use one IP and 443 port then you will try configre NGINX to proxy all reuests line "/fs-socket/" to FreeSwitch port 7443. It is works fine but FreeSwitch cannot not see real client IP address like folowing. Captured on Amazon server. freeswitch@ip-172-31-29-87.us-west-2.compute.internal> sofia status profile internal reg Registrations: ================================================================================================= Call-ID: f1e8c7ca-8f50-4285-fd1a-148d2f1d1b88 User: 23@46.218.201.23 Contact: "23" <sips:23@df7jal23ls0d.invalid ;rtcweb-breaker=no;transport=wss;fs_nat=yes;fs_path=sips%3A23%40172.31.29.87%3A37244%3Brtcweb-breaker%3Dno%3Btransport%3Dwss> Agent: IM-client/OMA1.0 sipML5-v1.2016.03.04 Status: Registered(TLS-NAT)(unknown) EXP(2016-12-24 09:42:43) EXPSECS(230) Ping-Status: Reachable Ping-Time: 0.00 Host: ip-172-31-29-87.us-west-2.compute.internal IP: 172.31.29.87 Port: 37244 Auth-User: 23 Auth-Realm: 46.218.201.23 MWI-Account: 23@46.218.201.23 Total items returned: 1 ================================================================================================= Displayed real IP address of NGINX Also when received INVITE then variables like network_addr will cantain real IP of NGINX. Then you can try confgire nginx like ng proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing. NGINX not understand SIP messages and cannot do it. Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
I'd recommend you to use HAPROXY as load-balancer for websockets as it can be simplier configured as statefull proxy. 2016-12-24 12:05 GMT+02:00 Sergey Safarov <s.safarov@gmail.com>:
Hello guys I want configure user frendly WebRTC server based on FreeSwitch and SipML5 client.
It can be easy done in FreeSwitch and NGINX is bounded to different IP/ports. But if you wants use one IP and 443 port then you will try configre NGINX to proxy all reuests line "/fs-socket/" to FreeSwitch port 7443.
It is works fine but FreeSwitch cannot not see real client IP address like folowing. Captured on Amazon server.
freeswitch@ip-172-31-29-87.us-west-2.compute.internal> sofia status profile internal reg
Registrations: ============================================================ ===================================== Call-ID: f1e8c7ca-8f50-4285-fd1a-148d2f1d1b88 User: 23@46.218.201.23 Contact: "23" <sips:23@df7jal23ls0d.invalid; rtcweb-breaker=no;transport=wss;fs_nat=yes;fs_path=sips% 3A23%40172.31.29.87%3A37244%3Brtcweb-breaker%3Dno%3Btransport%3Dwss> Agent: IM-client/OMA1.0 sipML5-v1.2016.03.04 Status: Registered(TLS-NAT)(unknown) EXP(2016-12-24 09:42:43) EXPSECS(230) Ping-Status: Reachable Ping-Time: 0.00 Host: ip-172-31-29-87.us-west-2.compute.internal IP: 172.31.29.87 Port: 37244 Auth-User: 23 Auth-Realm: 46.218.201.23 MWI-Account: 23@46.218.201.23
Total items returned: 1 ============================================================ =====================================
Displayed real IP address of NGINX
Also when received INVITE then variables like network_addr will cantain real IP of NGINX.
Then you can try confgire nginx like ng
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing. NGINX not understand SIP messages and cannot do it.
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Alexandru Covalschi VoIP engineer and system administrator tel: +37367398493
Hello Alexander But in haproxy FreeSwitch will see IP address of haproxy server for all cases. How to see real IP of WEbRTC device in FS when used proxy? Sergey вт, 3 янв. 2017 г. в 23:34, Alexandru Covalschi <568691@gmail.com>:
I'd recommend you to use HAPROXY as load-balancer for websockets as it can be simplier configured as statefull proxy.
2016-12-24 12:05 GMT+02:00 Sergey Safarov <s.safarov@gmail.com>:
Hello guys I want configure user frendly WebRTC server based on FreeSwitch and SipML5 client.
It can be easy done in FreeSwitch and NGINX is bounded to different IP/ports. But if you wants use one IP and 443 port then you will try configre NGINX to proxy all reuests line "/fs-socket/" to FreeSwitch port 7443.
It is works fine but FreeSwitch cannot not see real client IP address like folowing. Captured on Amazon server.
freeswitch@ip-172-31-29-87.us-west-2.compute.internal> sofia status profile internal reg
Registrations:
================================================================================================= Call-ID: f1e8c7ca-8f50-4285-fd1a-148d2f1d1b88 User: 23@46.218.201.23 Contact: "23" <sips:23@df7jal23ls0d.invalid ;rtcweb-breaker=no;transport=wss;fs_nat=yes;fs_path=sips%3A23%40172.31.29.87%3A37244%3Brtcweb-breaker%3Dno%3Btransport%3Dwss> Agent: IM-client/OMA1.0 sipML5-v1.2016.03.04 Status: Registered(TLS-NAT)(unknown) EXP(2016-12-24 09:42:43) EXPSECS(230) Ping-Status: Reachable Ping-Time: 0.00 Host: ip-172-31-29-87.us-west-2.compute.internal IP: 172.31.29.87 Port: 37244 Auth-User: 23 Auth-Realm: 46.218.201.23 MWI-Account: 23@46.218.201.23
Total items returned: 1
=================================================================================================
Displayed real IP address of NGINX
Also when received INVITE then variables like network_addr will cantain real IP of NGINX.
Then you can try confgire nginx like ng
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing. NGINX not understand SIP messages and cannot do it.
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Alexandru Covalschi VoIP engineer and system administrator tel: +37367398493 <+373%20673%2098%20493>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Why do you need it actually? Freeswitch will see proxy IP, yes, but the websocket connection will be bind to one of the ports of haproxy and it should work fine.
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing First of all Freeswitch doesn't require those headers. Well for that you should use STUN and set that in your clients application. Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine).
Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
For particular IP addresses I want write custom dialplan. And use one entry point for HTTP and WebSocket traffic - nginx or similar wevserver over https URI. Sergey ср, 4 янв. 2017 г. в 0:03, Alexandru Covalschi <568691@gmail.com>:
Why do you need it actually? Freeswitch will see proxy IP, yes, but the websocket connection will be bind to one of the ports of haproxy and it should work fine.
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing First of all Freeswitch doesn't require those headers. Well for that you should use STUN and set that in your clients application. Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine).
Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493 <+373%20673%2098%20493>
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Then you must specify SIP headers from SIPML5 directly as I said before. Actually having webserver serving also as websocket proxy is kinda terrible idea as webrtc clients will share same threads with simple web ones. ________________________________ Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493
3 янв. 2017 г., в 23:43, Sergey Safarov <s.safarov@gmail.com> написал(а):
For particular IP addresses I want write custom dialplan. And use one entry point for HTTP and WebSocket traffic - nginx or similar wevserver over https URI.
Sergey
ср, 4 янв. 2017 г. в 0:03, Alexandru Covalschi <568691@gmail.com <mailto:568691@gmail.com>>: Why do you need it actually? Freeswitch will see proxy IP, yes, but the websocket connection will be bind to one of the ports of haproxy and it should work fine.
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing First of all Freeswitch doesn't require those headers. Well for that you should use STUN and set that in your clients application. Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine).
Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493 <tel:+373%20673%2098%20493>
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
ср, 4 янв. 2017 г. в 0:03, Alexandru Covalschi <568691@gmail.com>:
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing First of all Freeswitch doesn't require those headers.
This header required to auth particular SIP/WebRTC clients by IP addresses via proxy daemons. Well for that you should use STUN and set that in your clients application.
Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine).
If i place Kamailio instead of http proxy server, then i must have two entry points: 1) for http trafic - http server; 2) web-socket trafic - Kamailio. But i wants avoid configuration with more than one entry point. Sergey ________________________________
Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493 <+373%20673%2098%20493>
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If you go deeper into websockets you'll understand that WS traffic has very little common with HTTP (actually it is more like HTTP/2) and it is generally a good idea to separate http and ws traffic, You can join @ru_freeswitch channel on telegram, as what we are discussing now is offtopic on that list. ________________________________ Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493
3 янв. 2017 г., в 23:51, Sergey Safarov <s.safarov@gmail.com> написал(а):
ср, 4 янв. 2017 г. в 0:03, Alexandru Covalschi <568691@gmail.com <mailto:568691@gmail.com>>:
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing First of all Freeswitch doesn't require those headers. This header required to auth particular SIP/WebRTC clients by IP addresses via proxy daemons.
Well for that you should use STUN and set that in your clients application. Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine). If i place Kamailio instead of http proxy server, then i must have two entry points: 1) for http trafic - http server; 2) web-socket trafic - Kamailio.
But i wants avoid configuration with more than one entry point.
Sergey
________________________________ Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493 <tel:+373%20673%2098%20493>
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I think nginx web server is well designed daemon for thousand of clients. As example https://www.scalescale.com/tips/nginx/nginx-benchmarking-using-siedge/# ср, 4 янв. 2017 г. в 0:51, Sergey Safarov <s.safarov@gmail.com>:
ср, 4 янв. 2017 г. в 0:03, Alexandru Covalschi <568691@gmail.com>:
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing
First of all Freeswitch doesn't require those headers.
This header required to auth particular SIP/WebRTC clients by IP addresses via proxy daemons.
Well for that you should use STUN and set that in your clients application. Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine).
If i place Kamailio instead of http proxy server, then i must have two entry points: 1) for http trafic - http server; 2) web-socket trafic - Kamailio.
But i wants avoid configuration with more than one entry point.
Sergey
________________________________ Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493 <+373%20673%2098%20493>
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
That example is not about SIP over WebRTC. Well another way which you can try is to perform an HTTP 301 redirect to the address:port you want to reach, however I still think putting Kamailio instead of nginx will let you do a lot more flexible stuff with SIP not changing the client part. ________________________________ Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493
3 янв. 2017 г., в 23:51, Sergey Safarov <s.safarov@gmail.com> написал(а):
ср, 4 янв. 2017 г. в 0:03, Alexandru Covalschi <568691@gmail.com <mailto:568691@gmail.com>>:
But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing First of all Freeswitch doesn't require those headers. This header required to auth particular SIP/WebRTC clients by IP addresses via proxy daemons.
Well for that you should use STUN and set that in your clients application. Another way is to use Kamailio, yes, it can add those on the fly, but again - you must put it instead of the proxy server (which you may actually want to do as it is a SIP proxy by-desing and it works with websockets pretty fine). If i place Kamailio instead of http proxy server, then i must have two entry points: 1) for http trafic - http server; 2) web-socket trafic - Kamailio.
But i wants avoid configuration with more than one entry point.
Sergey
________________________________ Alexandru Covalschi VoIP Engineer and System Administrator tel: +373 673 98 493 <tel:+373%20673%2098%20493>
3 янв. 2017 г., в 22:47, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> написал(а):
Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (2)
-
Alexandru Covalschi
-
Sergey Safarov