Using domain name forwarding mqtt protocol, pit avoidance Guide

1. demand

We need to do it by domain name mqtt Link to . The advantage is that when we are backstage ip When things change , The front-end equipment can not be affected .

2. Use nginx Forward

Pay attention to problems ： Configure reverse proxy TCP The way , Need to use nginx Of stream Service node . The node is and http Nodes are juxtaposed .

The use of nginx Version of ：1.23.0

  Version problem , This is because some older versions require manual installation support stream. So if we use a higher version , These are supported by default .

2.1.nginx Configuration file in

  We are directly in the nginx.conf Internal configuration , Because of the need to sum http Same node .

The complete configuration file is also posted ：

stream {
    log_format proxy '$remote_addr [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time "$upstream_addr" '
                 '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';

    access_log /var/log/nginx/mqtt_access.log proxy;
    open_log_file_cache off;

    upstream mqtt_tcp_server {
        server xxx.xxx.xxx.xxx:1883;  # Here we need to change our own ip Address 
    }

    server {
        listen       1883;  # Listening port   You can also use 1883
        proxy_connect_timeout 150s;
        proxy_timeout 150s;
        proxy_pass mqtt_tcp_server;  # Reverse proxy address 
        proxy_buffer_size 3M;
        tcp_nodelay on;
    }
}

3. After configuration , restart nginx Don't take effect

netstat -tunpl

  Use this command , You can see that we are listening 1883 Whether the port is up . At the beginning of the abnormality , Because use nginx -t, There is no problem with grammar , In the use of nginx -s reload When the command starts . There are no abnormalities , But it turns out 1883 The port is still not up . Let's go check nginx Of error journal , Finally, an error was found .

2022/06/24 14:48:40 [emerg] 11768#11768: bind() to 0.0.0.0:1883 failed (13: Permission denied)

3.1. This problem , It's actually SELinux Open and close ports problem ;

View all open ports ：

semanage port -l

Look at a port ：

see 1883 Whether the port has been opened ： 

semanage port -l | grep 1883

  The results after the startup .

  see selinux in the light of http The policy of opening ports ：

semanage port -l | grep http_port_t 

Add port ：

The key is coming. , If the above result is not open , You need to add ports manually ：

semanage port -a -t http_port_t -p tcp 1883

 http Policy add open 1883 port .

close http A port of the policy ：

Last , If at some time , When we don't need to open this port , You can close the port ：

semanage port -d -t http_port_t -p tcp 1883