Hello Al,
nginx.conf:
From that setup where You use nginx for the stream proxy of ssl binkps I
would have a small comment. That's the trouble when You connect with more
than one node concurrently. The ip address is not forwarded through the proxy and You basically connect from localhost. That means when You connect with
more than one node You got the Duplicate I.P. message. I'm uncertain if this cannot be configured otherwise. But there a solution on how to connect with more than one node at once.
The Mystic BBS can be configured to listen on multiple ports with the BINKP server. That means what could be done is to setup several BINKP server listening on localhost. E.g. 24554, 24555, 24556, 24557, 24558. Then You can have 5 concurrent connections from the proxy server. The nginx can
load-balance and this is how it could be done:
stream {
upstream binkps {
server 127.0.0.1:24554 max_conns=1;
server 127.0.0.1:24555 max_conns=1;
server 127.0.0.1:24556 max_conns=1;
server 127.0.0.1:24557 max_conns=1;
server 127.0.0.1:24558 max_conns=1;
}
server {
listen 29543 ssl;
proxy_pass binkps;
ssl_certificate /etc/nginx/ssl/snake-oil.crt;
ssl_certificate_key /etc/nginx/ssl/snake-oil.key;
ssl_password_file /etc/nginx/ssl/password-file.txt;
ssl_preread on;
}
}
That will actually provide possibility of 5 concurrent connections from the nodes. The ssl_password_file parameter gives the file where the password for the certificate is stored.
In the upstream list of server the max_conns prevents load balancing of more than one client at once to the given binkp server.
Probably there is an easier solution. But this is what worked for me.
BTW: The solution can be to use stunnel as You wrote in that case the
following configuration can be used:
/etc/stunnel/stunnel.conf
[binkps]
accept = 29543
connect = 24554
cert = /etc/stunnel/stunnel.pem
protocol = proxy
However it still retains the shortcoming of just only one concurrent session from the node. The other is rejected with the BUSY message.
What I would really like to explore is the HAPROXY. However most of the solutions are made for http and https protocols. Therefore if You would like
to forward the real ip address it can be achieved only in that protocols.
I tried the configuration of nginx with the proxy option as follows:
listen 29543 ssl proxy_protocol;
and then
proxy_protocol on;
This works just for a moment when the client connects via the proxy to the BINKP. Just when the real ip address is forwarded then ... what I guess the BINKP server responds to the real ip ... but that's not accessible because
the connection is established from within the nginx... and then the response goes elsewhere. If one would use http then the directive
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
could be used. But that's not this case because the headers cannot be
modified when in the stream tcp nginx proxy mode.
That's about it. Correct me if I'm wrong.
Best regards
|08Shinobi <.Phenom.>
|08
|08BBS Toolbox
https://bbst.neocities.org
--- Mystic BBS v1.12 A45 2020/02/18 (Linux/64)
* Origin: Infoline BBS (21:1/153)