It may be a really simple question because i am a newbie about turn servers. I would like to run coturn server behind a load balancer such as nginx.
My case is:
I have a nginx load balancer on server which is 192.168.1.10. And listening port 3478 for requests. Also this server has public ip address such as 82.222..
I have a turn server (coturn) which is 192.168.1.11. And runing on port 3478 (this server is in the same network with load balancer)
I'm testing my turn server connectivity with this site: https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/
My problem is:
If i do nat port forwarding from my public ip address to coturn server without using load balancer, connectivity test is performing successfully. However, if i use nginx udp load balancing method for redirecting request to my turn server, connectivity test is returning "Authentication Failed" error.
Is there any idea about this issue? Any help about this issue is appreciated.
You have not included any specifics about your nginx configuration, example config files, how you tested, etc. This makes it difficult to help point you at the solution to your problem.
Note that the coturn TURN server has some documentation about load balancing; it can be found in the wiki on Github: https://github.com/coturn/coturn/wiki/TURN-Performance-and-Load-Balance
That being said, I must agree with comment from Philipp and say that DNS-based load balancing for TURN servers works very well. This scenario is mentioned briefly in the documentation above.
Hope this helps, and good luck :)
Related
I have drawed the following chart to help explain our situation:
We have an API running on the KESTREL WebServer in the back end. This is running as several instances in docker containers. In front of this, we have a HAProxy Load Balancer which directs the traffic to the Kestrel server with the least connections.
All of this so far is only available internally on our network.
We have one server accessible from the internet, running IIS on port 80 and 443.
In IIS we have added a SSL Certificate which encrypts the communication between the end user and our first entry point.
Is there any further need to encrypt the communication between IIS which proxies the request to our HAProxy on the internal network, and from there on, necessary to encrypt communication from HAProxy to the backends?
As far as my knowledge goes, the only benefit of this, would be that nobody on the internal network at our office can listen to the connections going between the servers, but please correct me if I am wrong here.
I am running two raspberry pis as a webserver (assume it is production and dev-env). Since I am running this on my private DSL line I am running all machines behind a FritzBox router. The router can route traffic for port 80 and 443 only to one server behind the router.
So I want all traffic to be routed to my productive environment.
The question is whether lighttpd (on the productive server) can be used to serve the productive content and also route all requests to the dev environment to the second web server.
I assume mod_proxy will do exactly that job but I want to make sure that I am on the right path...
Appreciate any advise on that.
If you want some requests, e.g. to /dev/ to go to the dev-env web server, then, yes, you can run mod_proxy on the production server to handle all requests, and to act as reverse proxy to backend dev-env web server for request to /dev/...
Can you run a Selenium server hub behind nginx, to proxy port 443/ssl (or 80 without) to localhost:4444 where Selenium server is bound? My remote nodes won't connect to Selenium server behind nginx, only if I specifically open port 4444 in the firewall and bypass nginx do remote nodes connect.
Not sure if nginx handles this. I imagine the problem is more that your network firewall blocks ports outside 443 and certain others, and expects all traffic to go via HTTPS.
Get your network administrators to allow a punch-through for port 443.
Host your CI platform behind the firewalled network
Look for an alternate way to access the application nodes -- some firewalled networks allow access to public nodes from a private network via a different IP/hostname from the normal ones
I don't think you could really run Selenium on, say, port 80, because the selenium server itself is not quite really a web service.
it's maybe a bit late for answering the question of #xref. However, I have just deployed my Selenium Grid behind Nginx.
In order to do so, I used Docker and Docker-Compose. I describe how to do it here
I hope it will be helpful for you.
I followed the instructions from this link:
How do you get Amazon's ELB with HTTPS/SSL to work with Web Sockets? to set up ELB to work with Websocket (having ELB forward 443 to 8443 on TCP mode). Now I am seeing this issue for wss: server sends message1, client does not receive it; after few seconds, server sends message2, client receives both messages (both messages are around 30 bytes). I can reproduce the issue fairly easily. If I set up port forwarding with iptable on the server and have client connecting directly to the server (port 443), I don't have the problem Also, the issue seems to happen only to wss. ws works fine.
The server is running jetty8.
I checked EC2 forums and did not really find anything. I am wondering if anyone has seen the same issue.
Thanks
From what you describe, this pretty likely is a buffering issue with ELB. Quick research suggests that this actually is the issue.
From the ELB docs:
When you use TCP for both front-end and back-end connections, your
load balancer will forward the request to the back-end instances
without modification to the headers. This configuration will also not
insert cookies for session stickiness or the X-Forwarded-* headers.
When you use HTTP (layer 7) for both front-end and back-end
connections, your load balancer parses the headers in the request and
terminates the connection before re-sending the request to the
registered instance(s). This is the default configuration provided by
Elastic Load Balancing.
From the AWS forums:
I believe this is HTTP/HTTPS specific but not configurable but can't
say I'm sure. You may want to try to use the ELB in just plain TCP
mode on port 80 which I believe will just pass the traffic to the
client and vice versa without buffering.
Can you try to make more measurements and see how this delay depends on the message size?
Now, I am not entirely sure what you already did and what failed and what did not fail. From the docs and the forum post, however, the solution seems to be using the TCP/SSL (Layer 4) ELB type for both, front-end and back-end.
This resonates with "Nagle's algorithm" ... the TCP stack could be configured to bundling requests before sending them over the wire to reduce traffic. This would explain the symptoms, but worth a try
I need a Reverse Proxy to front both Lablz Web server and SSL VPN Adito (SSL Explorer fork) by sitting on one IP/port. Failed to achieve that with Nginx. Failed to use Adito as a generic reverse HTTP proxy.
Can HAProxy fall back to being a TCP proxy if it does not sense HTTP traffic?
In other words can it fall back to Layer 4 if its Layer 7 inspection determines this is not HTTP traffic?
Here is my setup
EC2 machine with one public IP (Elastic IP).
Only one port is open - 443.
Stunnel is sitting on 443 and is passing traffic to HAProxy (I do not like to use Stunnel but HAProxy does not have full support for SSL yet, unlike Nginx).
HAProxy must be configured to pass some HTTP traffic to one server (Apache server which fronts the SVN server) and the rest of the HTTP traffic to our Lablz Web/App server.
All non-HTTP traffic must be forwarded to Adito VPN.
This traffic is:
VNC, NX, SMB
... and all other protocols that Adito supports
I can not rely on source IP address or port to split traffic into HTTP and non-HTTP.
So, can such config be accomplished in HAProxy? Can any other reverse proxy be used for this? Let me know if I am not thinking right about HAProxy and an alternative approach is possible.
BTW, Adito SSL VPN is amazing and if this setup works we will be able to provide Lablz developers with a fantastic one-click single-login secure VNC-over-HTTPS access to their boxes in the cloud.
No solution exists for this but via Adito - please prove me wrong. But please do not say that VNC over SSH is better. Yes, VNC-over-SSH is faster, more secure, but also is much harder (for our target user base) to setup and presumes that user is behind the firewall that allows outbound traffic on port 22 (not always the case).
Besides, Adito is much more than the remote access gateway - it is a full blown in-browser VPN, a software distribution platform and more. I am not associated with Adito guys - see my Adito post on our Lablz blog.
OK, first off, I'd use a simple firewall to divide all HTTP from NON-HTTP traffic. What you need is packet inspection to figure out what it is that is coming in.
Neither haproxy or nginx can do that. They are both made for web traffic and I don't see how they could inspect traffic to guess what it is that they are dealing with.
Update: Looked into this it a bit and with iptables you could probably use string matching to devide the traffic. However, that's all tricky, especially with the encrypted nature. A friend of mine discovered l7-filter and this looks like what you need. Let me know if this helps.