mqtt forward

[dremeier]

can't get through nginx with a mosquito_pub! I'm using thingsboard and have to forward a ddns address to the local thingsboard server with the mqtt protocol. Websockets are enabled and firewall forward the correct port and works. Is there any workaround to get it working through nginx? Any help is appreciated.

[manicmoose]

I have no idea about thingsboard, but I have mosquitto working through nginx with SSL.
Connections are coming through Cloudflare. My setup in case it can help you:

Details tab:

• Scheme: http
• Forward hostname/ip: <your.server.name>
• Forward port: 9001
• Block common exploits - ticked
• Websockets support - ticked

SSL tab:

• Select your SSL certificate
• HTTP/2 Support - ticked
  NB. DO NOT tick "force ssl" or any others.

Advanced tab:

# These are the Cloudflare IP's:
set_real_ip_from    103.21.244.0/22;
set_real_ip_from    103.22.200.0/22;
set_real_ip_from    103.31.4.0/22;
set_real_ip_from    104.16.0.0/13;
set_real_ip_from    104.24.0.0/14;
set_real_ip_from    108.162.192.0/18;
set_real_ip_from    131.0.72.0/22;
set_real_ip_from    141.101.64.0/18;
set_real_ip_from    162.158.0.0/15;
set_real_ip_from    172.64.0.0/13;
set_real_ip_from    173.245.48.0/20;
set_real_ip_from    188.114.96.0/20;
set_real_ip_from    190.93.240.0/20;
set_real_ip_from    197.234.240.0/22;
set_real_ip_from    198.41.128.0/17;
set_real_ip_from    2400:cb00::/32;
set_real_ip_from    2606:4700::/32;
set_real_ip_from    2803:f800::/32;
set_real_ip_from    2405:b500::/32;
set_real_ip_from    2405:8100::/32;
set_real_ip_from    2a06:98c0::/29;
set_real_ip_from    2c0f:f248::/32;

add_header  X-Served-By $host;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_buffering off;
real_ip_header CF-Connecting-IP;
real_ip_recursive on;
underscores_in_headers on;

On the host:

mosquitto.conf:

pid_file /run/mosquitto/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

log_type error
websockets_log_level 1023
connection_messages false
log_dest file /var/log/mosquitto/mosquitto.log

include_dir /etc/mosquitto/conf.d

conf.d/myconfig.conf:

# Using this config, we are forcing all the traffic through the Cloudflare SSL tunnel
# anyway so we don't need to specify certficates here.

allow_anonymous true
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl

listener 9001
protocol websockets

listener 1883
protocol mqtt
log_type error

That's all....I hope it helps. Good luck.

[Hisma]

I have no idea about thingsboard, but I have mosquitto working through nginx with SSL. Connections are coming through Cloudflare. My setup in case it can help you:

Details tab:

• Scheme: http
• Forward hostname/ip: <your.server.name>
• Forward port: 9001
• Block common exploits - ticked
• Websockets support - ticked

SSL tab:

• Select your SSL certificate
• HTTP/2 Support - ticked
  NB. DO NOT tick "force ssl" or any others.

Advanced tab:

# These are the Cloudflare IP's:
set_real_ip_from    103.21.244.0/22;
set_real_ip_from    103.22.200.0/22;
set_real_ip_from    103.31.4.0/22;
set_real_ip_from    104.16.0.0/13;
set_real_ip_from    104.24.0.0/14;
set_real_ip_from    108.162.192.0/18;
set_real_ip_from    131.0.72.0/22;
set_real_ip_from    141.101.64.0/18;
set_real_ip_from    162.158.0.0/15;
set_real_ip_from    172.64.0.0/13;
set_real_ip_from    173.245.48.0/20;
set_real_ip_from    188.114.96.0/20;
set_real_ip_from    190.93.240.0/20;
set_real_ip_from    197.234.240.0/22;
set_real_ip_from    198.41.128.0/17;
set_real_ip_from    2400:cb00::/32;
set_real_ip_from    2606:4700::/32;
set_real_ip_from    2803:f800::/32;
set_real_ip_from    2405:b500::/32;
set_real_ip_from    2405:8100::/32;
set_real_ip_from    2a06:98c0::/29;
set_real_ip_from    2c0f:f248::/32;

add_header  X-Served-By $host;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_buffering off;
real_ip_header CF-Connecting-IP;
real_ip_recursive on;
underscores_in_headers on;

On the host:

mosquitto.conf:

pid_file /run/mosquitto/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

log_type error
websockets_log_level 1023
connection_messages false
log_dest file /var/log/mosquitto/mosquitto.log

include_dir /etc/mosquitto/conf.d

conf.d/myconfig.conf:

# Using this config, we are forcing all the traffic through the Cloudflare SSL tunnel
# anyway so we don't need to specify certficates here.

allow_anonymous true
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl

listener 9001
protocol websockets

listener 1883
protocol mqtt
log_type error

That's all....I hope it helps. Good luck.

just want to thank you for providing this. I followed your instructions step-by-step and it worked!
Here's what's cool about setting up this way - your broker can handle either unsescure mqtt traffic or secure wss traffic at the same time! So however the client decides to connect, the broker will handle both simultaneously.
Note - there's only a few things necessary in your mosquitto.conf that actually matter to pull this off. Here's what mine looks like -

allow_anonymous false

## Listener
listener 1883
password_file /mosquitto/data/passwd

# Optional websockets listener, if used this must be exposed in the
# docker-compose configuration
listener 8080
protocol websockets

## Some sensible options - tweak as per your requirements

# Set max_keepalive to be reasonably higher than your max value
max_keepalive 1800

# max_packet_size can protect devices against unreasonably large payloads
max_packet_size 100000000

# Reduce network latency
set_tcp_nodelay true

And of those, I could remove those "sensible options". What matters is the two listeners, mqtt on port 1883 and websockets on port 8080 (in my setup).
What you provided w/ the actual nginx proxy manager config side is where the real magic is. No way I would have figured that out on my own!
Cheers.