Hello All, I have to proxy all websocket requests though a nginx server. Right now I am using next configuration: map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 443; server_name wss.somedomain.com.ua; ssl on; ssl_certificate /etc/nginx/cert.pem; ssl_certificate_key /etc/nginx/private.key; location / { proxy_pass http://127.0.0.1:5066; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_read_timeout 86400s; } access_log /var/log/nginx/wss_access; error_log /var/log/nginx/wss_error debug; } I dumped traffic from nginx and found out that "switching protocol" phrase was successful but INVITE message from my browser in pending state. Maybe FreeSWITCH wants real IP not loopback? Who have faced with similar problem? BR, Anton
I'm also running behind Nginx and what I found worked was to proxy to the actual IP address (192.168.1.1 vs. 127.0.0.1), then explicitly removing 192.168.1.1 from the localnet ACL in acl.conf. I had to remove 192.168.1.1 from localnet so FS will offer external IP addresses for RTP. -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Anton Sent: Saturday, January 30, 2016 2:20 PM To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] WebSocket behind NGINX Hello All, I have to proxy all websocket requests though a nginx server. Right now I am using next configuration: map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 443; server_name wss.somedomain.com.ua; ssl on; ssl_certificate /etc/nginx/cert.pem; ssl_certificate_key /etc/nginx/private.key; location / { proxy_pass http://127.0.0.1:5066; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_read_timeout 86400s; } access_log /var/log/nginx/wss_access; error_log /var/log/nginx/wss_error debug; } I dumped traffic from nginx and found out that "switching protocol" phrase was successful but INVITE message from my browser in pending state. Maybe FreeSWITCH wants real IP not loopback? Who have faced with similar problem? BR, Anton _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi, Sorry for not answering for a long time. Dan, thank you, your recommendation really helped me. So in order to proxy websocket request you need: 1. Proxy websocket requests in this way WSS -> (NGINX) -> FS WSS or WS -> (NGINX) -> FS WS 2. Modify local-network-acl 3. Modify apply-candidate-acl if you would like to drop more rtp candidates PS: I highly recommend to watch this video about NAT issues and ACL configuration: https://www.youtube.com/watch?v=_WSx-T6TriI BR, Anton Voylenko On 01/30/2016 09:20 PM, Anton wrote:
Hello All,
I have to proxy all websocket requests though a nginx server. Right now I am using next configuration:
map $http_upgrade $connection_upgrade { default upgrade; '' close; }
server { listen 443; server_name wss.somedomain.com.ua;
ssl on; ssl_certificate /etc/nginx/cert.pem; ssl_certificate_key /etc/nginx/private.key;
location / { proxy_pass http://127.0.0.1:5066; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_read_timeout 86400s; }
access_log /var/log/nginx/wss_access; error_log /var/log/nginx/wss_error debug; }
I dumped traffic from nginx and found out that "switching protocol" phrase was successful but INVITE message from my browser in pending state. Maybe FreeSWITCH wants real IP not loopback? Who have faced with similar problem?
BR, Anton
Anton, I'm glad my input was useful. As for WSS vs WS, the fact you're using security bubbles up into the SIP messages themselves. I initially tried: Browser >> WSS >> Nginx >> WS >> FS FS does not like this because the protocol changes. You go from SIP/2.0/WSS to SIP/2.0/WS and FS won't allow that. Also, in some instances, you will get SIP URL changes. For example: sip:1234@domain.com vs. sips:1234@domain.com. The reason to go with WS to FS was to skip an encrypt/decrypt cycle on network traffic that never left the machine. I finally decided that trying to patch the SIP traffic was bound to fail at some point and we're only saving the encrypt/decrypt on the SIP traffic itself, so I went back to Browser >> WSS >> Nginx >>> WSS >> FS -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Anton Sent: Saturday, February 06, 2016 4:39 PM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] WebSocket behind NGINX Hi, Sorry for not answering for a long time. Dan, thank you, your recommendation really helped me. So in order to proxy websocket request you need: 1. Proxy websocket requests in this way WSS -> (NGINX) -> FS WSS or WS -> (NGINX) -> FS WS 2. Modify local-network-acl 3. Modify apply-candidate-acl if you would like to drop more rtp candidates PS: I highly recommend to watch this video about NAT issues and ACL configuration: https://www.youtube.com/watch?v=_WSx-T6TriI BR, Anton Voylenko On 01/30/2016 09:20 PM, Anton wrote:
Hello All,
I have to proxy all websocket requests though a nginx server. Right now I am using next configuration:
map $http_upgrade $connection_upgrade { default upgrade; '' close; }
server { listen 443; server_name wss.somedomain.com.ua;
ssl on; ssl_certificate /etc/nginx/cert.pem; ssl_certificate_key /etc/nginx/private.key;
location / { proxy_pass http://127.0.0.1:5066; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_read_timeout 86400s; }
access_log /var/log/nginx/wss_access; error_log /var/log/nginx/wss_error debug; }
I dumped traffic from nginx and found out that "switching protocol" phrase was successful but INVITE message from my browser in pending state. Maybe FreeSWITCH wants real IP not loopback? Who have faced with similar problem?
BR, Anton
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Guys, Has anyone done this before with HA Proxy, I have been trying the same as mentioned above: Browser >> WSS >> HA Proxy >>> WSS >> Kamailio->FS I am getting TLS errors in Kamailio logs hence not even reaching my FS cluster. My HA config looks like: *frontend public bind *:10090 ssl crt /etc/haproxy/certs/cert.pem acl is_websocket hdr_end(host) -i m1.some-domain.com <http://m1.some-domain.com> use_backend wss if is_websocket default_backend wssbackend wss timeout server 600s server ws1 k1.some-domain.com:10090 <http://k1.some-domain.com:10090> server ws1 k2.some-domain.com:10090 <http://k2.some-domain.com:10090>* Need some direction, thanks in advance. Regards, Jade On Mon, Feb 8, 2016 at 9:36 PM, Dan Edwards <DEdwards@vertical.com> wrote:
Anton,
I'm glad my input was useful. As for WSS vs WS, the fact you're using security bubbles up into the SIP messages themselves. I initially tried:
Browser >> WSS >> Nginx >> WS >> FS
FS does not like this because the protocol changes. You go from SIP/2.0/WSS to SIP/2.0/WS and FS won't allow that. Also, in some instances, you will get SIP URL changes. For example: sip:1234@domain.com vs. sips:1234@domain.com.
The reason to go with WS to FS was to skip an encrypt/decrypt cycle on network traffic that never left the machine. I finally decided that trying to patch the SIP traffic was bound to fail at some point and we're only saving the encrypt/decrypt on the SIP traffic itself, so I went back to
Browser >> WSS >> Nginx >>> WSS >> FS
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Anton Sent: Saturday, February 06, 2016 4:39 PM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] WebSocket behind NGINX
Hi,
Sorry for not answering for a long time.
Dan, thank you, your recommendation really helped me.
So in order to proxy websocket request you need: 1. Proxy websocket requests in this way WSS -> (NGINX) -> FS WSS or WS -> (NGINX) -> FS WS 2. Modify local-network-acl 3. Modify apply-candidate-acl if you would like to drop more rtp candidates
PS: I highly recommend to watch this video about NAT issues and ACL configuration: https://www.youtube.com/watch?v=_WSx-T6TriI
BR, Anton Voylenko
On 01/30/2016 09:20 PM, Anton wrote:
Hello All,
I have to proxy all websocket requests though a nginx server. Right now I am using next configuration:
map $http_upgrade $connection_upgrade { default upgrade; '' close; }
server { listen 443; server_name wss.somedomain.com.ua;
ssl on; ssl_certificate /etc/nginx/cert.pem; ssl_certificate_key /etc/nginx/private.key;
location / { proxy_pass http://127.0.0.1:5066; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_read_timeout 86400s; }
access_log /var/log/nginx/wss_access; error_log /var/log/nginx/wss_error debug; }
I dumped traffic from nginx and found out that "switching protocol" phrase was successful but INVITE message from my browser in pending state. Maybe FreeSWITCH wants real IP not loopback? Who have faced with similar problem?
BR, Anton
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Dan, dig you get it work? Is it possible to use: wss -> nginx --> ws -> fs ? I see the same behaviour, the VIA header that arrives to fs in the ws port contains SIP/2.0/WSS and of course, fs will reject the request because its a different protocol... nta.c:3146 agent_check_request_via() nta: Via check: invalid transport "SIP/2.0/WSS" from 192.168.10.5:54074 I guess that what we need here is some sort of "helper" in nignx that replaces WSS to WS. On 02/08/2016 05:36 PM, Dan Edwards wrote:
Anton,
I'm glad my input was useful. As for WSS vs WS, the fact you're using security bubbles up into the SIP messages themselves. I initially tried:
Browser >> WSS >> Nginx >> WS >> FS
FS does not like this because the protocol changes. You go from SIP/2.0/WSS to SIP/2.0/WS and FS won't allow that. Also, in some instances, you will get SIP URL changes. For example: sip:1234@domain.com vs. sips:1234@domain.com.
The reason to go with WS to FS was to skip an encrypt/decrypt cycle on network traffic that never left the machine. I finally decided that trying to patch the SIP traffic was bound to fail at some point and we're only saving the encrypt/decrypt on the SIP traffic itself, so I went back to
Browser >> WSS >> Nginx >>> WSS >> FS
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Anton Sent: Saturday, February 06, 2016 4:39 PM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] WebSocket behind NGINX
Hi,
Sorry for not answering for a long time.
Dan, thank you, your recommendation really helped me.
So in order to proxy websocket request you need: 1. Proxy websocket requests in this way WSS -> (NGINX) -> FS WSS or WS -> (NGINX) -> FS WS 2. Modify local-network-acl 3. Modify apply-candidate-acl if you would like to drop more rtp candidates
PS: I highly recommend to watch this video about NAT issues and ACL configuration: https://www.youtube.com/watch?v=_WSx-T6TriI
BR, Anton Voylenko
On 01/30/2016 09:20 PM, Anton wrote:
Hello All,
I have to proxy all websocket requests though a nginx server. Right now I am using next configuration:
map $http_upgrade $connection_upgrade { default upgrade; '' close; }
server { listen 443; server_name wss.somedomain.com.ua;
ssl on; ssl_certificate /etc/nginx/cert.pem; ssl_certificate_key /etc/nginx/private.key;
location / { proxy_pass http://127.0.0.1:5066; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_read_timeout 86400s; }
access_log /var/log/nginx/wss_access; error_log /var/log/nginx/wss_error debug; }
I dumped traffic from nginx and found out that "switching protocol" phrase was successful but INVITE message from my browser in pending state. Maybe FreeSWITCH wants real IP not loopback? Who have faced with similar problem?
BR, Anton
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Saludos / Regards / Cumprimentos António Silva
participants (4)
-
Anton
-
António Silva
-
Dan Edwards
-
Jade SZ