[Galene] Help needed on network settings

[Galene] Help needed on network settings

[Franck Routier]

[-- Attachment #1: Type: text/plain, Size: 4195 bytes --]

Hi,

I'm trying to setup a galene instance in the following context:

* one physical server (hosted at OVH) with public IP ww.xx.yy.zz
* on this server, incus (https://linuxcontainers.org/incus/docs/main/) is used to handle different containers: galene is in one of this containers (running Ubuntu)
* another container is running nginx as a reverse proxy
* dns name galene.mydomain.net points to ww.xx.yy.zz

What I did is:

* on the main server, forward ports tcp/1194, upd/1194 and udp/18100-19100 to same ports on galene container
(I tested with netcat that this port forwarding is effective)

* on nginx, proxypass url https://galene.mydomain.net to galene container on port 10000:

server { 
   if ($host = galene.mydomain.net) { 
       return 301 https://$host$request_uri; 
   }
   listen 80; 
   server_name galene.mydomain.net; 
   return 301 https://$host$request_uri; 
}

server { 
   listen  443 http2 ssl; 
   server_name galene.mydomain.net; 

   location / { 
       proxy_pass http://10.87.94.201:10000/; 
       proxy_set_header Host $http_host; 
       proxy_set_header X-Forwarded-Host $host:$server_port; 
       proxy_set_header X-Forwarded-Server $host; 
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
       proxy_set_header  X-Real-IP $remote_addr; 
       proxy_set_header Upgrade $http_upgrade; 
       proxy_set_header Connection "Upgrade"; 
   } 

   ssl_certificate /etc/letsencrypt/live/several.mydomain.net/fullchain.pem; # managed by Certbot 
   ssl_certificate_key /etc/letsencrypt/live/several.mydomain.net/privkey.pem; # managed by Certbot

* on galene container, systemd service is launched with 'galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz
:1194 -udp-range 18100-19100'

systemctl status galene says:

● galene.service - Galene 
    Loaded: loaded (/etc/systemd/system/galene.service; enabled; preset: enabled) 
   Drop-In: /run/systemd/system/service.d 
            └─zzz-lxc-service.conf 
    Active: active (running) since Tue 2024-10-22 11:57:07 UTC; 18h ago 
  Main PID: 535 (galene) 
     Tasks: 17 (limit: 76943) 
    Memory: 4.9M (peak: 9.5M) 
       CPU: 2.413s 
    CGroup: /system.slice/galene.service 
            └─535 /home/ubuntu/galene/galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz:1194 -udp-range 18100-19100 

Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Starting built-in TURN server on ww.xx.yy.zz:1194 
Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Relay test successful in 12.038506ms, RTT = 162.921µs 
Oct 22 14:54:17 galene galene[535]: turn ERROR: 2024/10/22 14:54:17 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
Oct 22 18:00:47 galene galene[535]: turn ERROR: 2024/10/22 18:00:47 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
Oct 22 21:26:00 galene galene[535]: turn ERROR: 2024/10/22 21:26:00 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
Oct 22 22:37:18 galene galene[535]: turn ERROR: 2024/10/22 22:37:18 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
Oct 22 23:57:07 galene galene[535]: 2024/10/22 23:57:07 Relay test successful in 18.841846ms, RTT = 203.679µs 
Oct 23 01:02:12 galene galene[535]: turn ERROR: 2024/10/23 01:02:12 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
Oct 23 05:03:13 galene galene[535]: turn ERROR: 2024/10/23 05:03:13 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
Oct 23 06:29:59 galene galene[535]: turn ERROR: 2024/10/23 06:29:59 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header

Now, I can access the web UI, but it seems RTC cannot be established.

What am I missed ?
I'm not a network wizard, any help is appreciated :-)

Franck

[-- Attachment #2: Type: text/html, Size: 7148 bytes --]

[Galene] Re: Help needed on network settings

[Franck Routier]

Hi,

using about:webrtc in firefox, I see quite a lot of attempts to initiate ICE / STUN communication on different addresses and ports.
It seems to finally communicate, but fails with an error:

STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): Received response; processing
STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): XOR-MAPPED-ADDRESS is bogus
STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): Error processing response: Invalid data, stun error code 0.
Inconsistent message method: 103 expected 001
ICE(PC:{247ed162-d0e5-4dfc-a5bc-7c7429fd06be} 1729756871462370 (id=57982058498 url=https://galene.mydomain.net/group/visio/)): Message does not correspond to any registered stun ctx

Does this make any sense to someone ?

Thanks
Franck


Le mercredi 23 octobre 2024, 08:42:33 CEST Franck Routier a écrit :
> Hi,
> 
> I'm trying to setup a galene instance in the following context:
> 
> * one physical server (hosted at OVH) with public IP ww.xx.yy.zz
> * on this server, incus (https://linuxcontainers.org/incus/docs/main/) is used to handle different containers: galene is in one of this containers (running Ubuntu)
> * another container is running nginx as a reverse proxy
> * dns name galene.mydomain.net points to ww.xx.yy.zz
> 
> What I did is:
> 
> * on the main server, forward ports tcp/1194, upd/1194 and udp/18100-19100 to same ports on galene container
> (I tested with netcat that this port forwarding is effective)
> 
> * on nginx, proxypass url https://galene.mydomain.net to galene container on port 10000:
> 
> server { 
>    if ($host = galene.mydomain.net) { 
>        return 301 https://$host$request_uri; 
>    }
>    listen 80; 
>    server_name galene.mydomain.net; 
>    return 301 https://$host$request_uri; 
> }
> 
> server { 
>    listen  443 http2 ssl; 
>    server_name galene.mydomain.net; 
> 
>    location / { 
>        proxy_pass http://10.87.94.201:10000/; 
>        proxy_set_header Host $http_host; 
>        proxy_set_header X-Forwarded-Host $host:$server_port; 
>        proxy_set_header X-Forwarded-Server $host; 
>        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
>        proxy_set_header  X-Real-IP $remote_addr; 
>        proxy_set_header Upgrade $http_upgrade; 
>        proxy_set_header Connection "Upgrade"; 
>    } 
> 
>    ssl_certificate /etc/letsencrypt/live/several.mydomain.net/fullchain.pem; # managed by Certbot 
>    ssl_certificate_key /etc/letsencrypt/live/several.mydomain.net/privkey.pem; # managed by Certbot
> 
> * on galene container, systemd service is launched with 'galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz
> :1194 -udp-range 18100-19100'
> 
> systemctl status galene says:
> 
> ● galene.service - Galene 
>     Loaded: loaded (/etc/systemd/system/galene.service; enabled; preset: enabled) 
>    Drop-In: /run/systemd/system/service.d 
>             └─zzz-lxc-service.conf 
>     Active: active (running) since Tue 2024-10-22 11:57:07 UTC; 18h ago 
>   Main PID: 535 (galene) 
>      Tasks: 17 (limit: 76943) 
>     Memory: 4.9M (peak: 9.5M) 
>        CPU: 2.413s 
>     CGroup: /system.slice/galene.service 
>             └─535 /home/ubuntu/galene/galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz:1194 -udp-range 18100-19100 
> 
> Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Starting built-in TURN server on ww.xx.yy.zz:1194 
> Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Relay test successful in 12.038506ms, RTT = 162.921µs 
> Oct 22 14:54:17 galene galene[535]: turn ERROR: 2024/10/22 14:54:17 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> Oct 22 18:00:47 galene galene[535]: turn ERROR: 2024/10/22 18:00:47 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> Oct 22 21:26:00 galene galene[535]: turn ERROR: 2024/10/22 21:26:00 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> Oct 22 22:37:18 galene galene[535]: turn ERROR: 2024/10/22 22:37:18 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> Oct 22 23:57:07 galene galene[535]: 2024/10/22 23:57:07 Relay test successful in 18.841846ms, RTT = 203.679µs 
> Oct 23 01:02:12 galene galene[535]: turn ERROR: 2024/10/23 01:02:12 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> Oct 23 05:03:13 galene galene[535]: turn ERROR: 2024/10/23 05:03:13 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> Oct 23 06:29:59 galene galene[535]: turn ERROR: 2024/10/23 06:29:59 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header
> 
> Now, I can access the web UI, but it seems RTC cannot be established.
> 
> What am I missed ?
> I'm not a network wizard, any help is appreciated :-)
> 
> Franck
> 

[Galene] Re: Help needed on network settings

[Franck Routier]

[-- Attachment #1: Type: text/plain, Size: 6172 bytes --]

It also seems it is trying to use udp ports on the galene side that are not in the udp-range I use in the command line:


État ICE
       Nommé
   Sélectionné
   Candidat local
                                                   Candidat distant






inprogress
   false
          false
                my.lo.ca.lip:37763/udp(host) [non-proxied]
   ww.xx.yy.zz:45618/udp(relay)






So it's trying to use udp 45618 on the galene side, which in not in the 18100-19100 range I specified and allowed on the firewall.
Is this expected ?

Franck

Le jeudi 24 octobre 2024, 10:11:27 CEST Franck Routier via Galene a écrit :
> Hi,
> 
> using about:webrtc in firefox, I see quite a lot of attempts to initiate ICE / STUN communication on different addresses and ports.
> It seems to finally communicate, but fails with an error:
> 
> STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): Received response; processing
> STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): XOR-MAPPED-ADDRESS is bogus
> STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): Error processing response: Invalid data, stun error code 0.
> Inconsistent message method: 103 expected 001
> ICE(PC:{247ed162-d0e5-4dfc-a5bc-7c7429fd06be} 1729756871462370 (id=57982058498 url=https://galene.mydomain.net/group/visio/)): Message does not correspond to any registered stun ctx
> 
> Does this make any sense to someone ?
> 
> Thanks
> Franck
> 
> 
> Le mercredi 23 octobre 2024, 08:42:33 CEST Franck Routier a écrit :
> > Hi,
> > 
> > I'm trying to setup a galene instance in the following context:
> > 
> > * one physical server (hosted at OVH) with public IP ww.xx.yy.zz
> > * on this server, incus (https://linuxcontainers.org/incus/docs/main/) is used to handle different containers: galene is in one of this containers (running Ubuntu)
> > * another container is running nginx as a reverse proxy
> > * dns name galene.mydomain.net points to ww.xx.yy.zz
> > 
> > What I did is:
> > 
> > * on the main server, forward ports tcp/1194, upd/1194 and udp/18100-19100 to same ports on galene container
> > (I tested with netcat that this port forwarding is effective)
> > 
> > * on nginx, proxypass url https://galene.mydomain.net to galene container on port 10000:
> > 
> > server { 
> >    if ($host = galene.mydomain.net) { 
> >        return 301 https://$host$request_uri; 
> >    }
> >    listen 80; 
> >    server_name galene.mydomain.net; 
> >    return 301 https://$host$request_uri; 
> > }
> > 
> > server { 
> >    listen  443 http2 ssl; 
> >    server_name galene.mydomain.net; 
> > 
> >    location / { 
> >        proxy_pass http://10.87.94.201:10000/; 
> >        proxy_set_header Host $http_host; 
> >        proxy_set_header X-Forwarded-Host $host:$server_port; 
> >        proxy_set_header X-Forwarded-Server $host; 
> >        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
> >        proxy_set_header  X-Real-IP $remote_addr; 
> >        proxy_set_header Upgrade $http_upgrade; 188.165.192.106:45618/udp(relay)
> >        proxy_set_header Connection "Upgrade"; 
> >    } 
> > 
> >    ssl_certificate /etc/letsencrypt/live/several.mydomain.net/fullchain.pem; # managed by Certbot 
> >    ssl_certificate_key /etc/letsencrypt/live/several.mydomain.net/privkey.pem; # managed by Certbot
> > 
> > * on galene container, systemd service is launched with 'galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz
> > :1194 -udp-range 18100-19100'
> > 
> > systemctl status galene says:
> > 
> > ● galene.service - Galene 
> >     Loaded: loaded (/etc/systemd/system/galene.service; enabled; preset: enabled) 
> >    Drop-In: /run/systemd/system/service.d 
> >             └─zzz-lxc-service.conf 
> >     Active: active (running) since Tue 2024-10-22 11:57:07 UTC; 18h ago 
> >   Main PID: 535 (galene) 
> >      Tasks: 17 (limit: 76943) 
> >     Memory: 4.9M (peak: 9.5M) 
> >        CPU: 2.413s 
> >     CGroup: /system.slice/galene.service 
> >             └─535 /home/ubuntu/galene/galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz:1194 -udp-range 18100-19100 
> > 
> > Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Starting built-in TURN server on ww.xx.yy.zz:1194 
> > Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Relay test successful in 12.038506ms, RTT = 162.921µs 
> > Oct 22 14:54:17 galene galene[535]: turn ERROR: 2024/10/22 14:54:17 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> > Oct 22 18:00:47 galene galene[535]: turn ERROR: 2024/10/22 18:00:47 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> > Oct 22 21:26:00 galene galene[535]: turn ERROR: 2024/10/22 21:26:00 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> > Oct 22 22:37:18 galene galene[535]: turn ERROR: 2024/10/22 22:37:18 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> > Oct 22 23:57:07 galene galene[535]: 2024/10/22 23:57:07 Relay test successful in 18.841846ms, RTT = 203.679µs 
> > Oct 23 01:02:12 galene galene[535]: turn ERROR: 2024/10/23 01:02:12 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> > Oct 23 05:03:13 galene galene[535]: turn ERROR: 2024/10/23 05:03:13 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header 
> > Oct 23 06:29:59 galene galene[535]: turn ERROR: 2024/10/23 06:29:59 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header
> > 
> > Now, I can access the web UI, but it seems RTC cannot be established.
> > 
> > What am I missed ?
> > I'm not a network wizard, any help is appreciated :-)
> > 
> > Franck
> > 
> 
> 
> 
> 

[-- Attachment #2: Type: text/html, Size: 17615 bytes --]

[Galene] Re: Help needed on network settings

[Juliusz Chroboczek]

Hello, and sorry for the delay.

> * on this server, incus (https://linuxcontainers.org/incus/docs/main/) is used
> to handle different containers: galene is in one of this containers (running
> Ubuntu)n

As you've noticed, containers introduce a lot of extra complexity as soon
as you use an interesting network protocol: they force you to do port
forwardings and other weird things.  What I do is to run Galene on the
bare hardware, but run it as its own user.  If you insist on running
Galene in a container, then you should give it access to the physical
network, not a virtualised one.

> Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Relay test successful
> in 12.038506ms, RTT = 162.921µs

Okay, so Galene can speak to itself.

> Oct 22 14:54:17 galene galene[535]: turn ERROR: 2024/10/22 14:54:17 Failed to
> handle datagram: failed to create stun message from packet: unexpected EOF: not
> enough bytes to read header

That looks like port 1194 is receiving messages that are not destined to
the TURN server.  Please double-check your forwarding configuration, and
make sure that you're not forwarding some other port to 1194.

On a machine that's *not* your server, please do the following:

    git clone https://github.com/pion/stun
    cd cmd/stun-nat-behaviour
    go run main.go -server your-server.example.org:1194

and post the output here.

-- Juliusz