It does not work when using the Nginx stream module for transmission

[xiebruce]

let's assume my server IP is 12.34.56.78, I had bind my domain mtg.example.com to 12.34.56.78.

I run mtg like this:

/usr/local/bin/mtg run [secert] --bind 0.0.0.0:12345

I set my telegram proxy like this, and it works fine:

but when I use nginx stream module to transmit it to mtg, it's not working

stream {
    log_format basic '$remote_addr [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time';

    access_log /var/logs/nginx/stream_access.log basic buffer=32k;

    # Identify SNI
    map $ssl_preread_server_name $backend_name {
        mtg.example.com mtg;
        .example.com web;
        # default to web
        default web;
    }

    # mtg
    upstream mtg {
        server 127.0.0.1:12345;
    }

    # web
    upstream web {
        server 127.0.0.1:444;
    }

    # listen 443
    server {
        listen 443 reuseport;
        listen [::]:443 reuseport;
        proxy_pass  $backend_name;
        ssl_preread on;
    }
}

I also tried to set ssl certificate in the stream server, not working too

# listen 443
server {
    listen 443 reuseport;
    listen [::]:443 reuseport;
    proxy_pass  $backend_name;
    ssl_preread on;

    #ssl start
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/private.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
    ssl_prefer_server_ciphers on;
    #ssl end
}

by the way, my ip and domain has substituted to 12.34.56.78 and mtg.example.com.

so, can someone or the author of mtg tried to make this work?

[9seconds]

To be frank, I've never tried to put mtg behind nginx so do not know what to advise here.

[wwbfred]

Nginx stream mode works in layer 4 and has nothing to do with the 7th layer application.
You need to check again and make sure your config file correct.
For instance, "$backend_name" need to be changed if the config file mentioned above is exact what you are using in your server.

[xiebruce]

@9seconds It doesn't matter, thank you all the same.

[xiebruce]

@wwbfred yeah, it should be work theoretically but not working in practice, I'll try to figure it out.

[wwbfred]

I put mtg behind nginx and it works well.

[xiebruce]

@wwbfred can you share you nginx config(after substituting sensitive info)? I really need this.

[Allineer]

@xiebruce,

/etc/nginx/nginx.conf:

...
stream {
    map $ssl_preread_server_name $route {
        example.com mtg;
        default web;
    }

    log_format stream '$remote_addr [$time_local] [$ssl_preread_server_name] [$route] $status $bytes_sent $bytes_received $session_time';
    access_log /var/log/nginx/stream.log stream;

    upstream mtg {
        server 127.0.0.1:3128;
    }
    upstream web {
        server 127.0.0.1:443;
    }
    server {
        listen 111.222.333.444:443;
        proxy_pass $route;
        ssl_preread on;
    }
}
...

[xiebruce]

@Allineer That's wizard, mine is nothing different with yours, but did you use two 443 port?

[Allineer]

@xiebruce, yup.

[9seconds]

Can you please verify this instruction? https://github.com/freejohn123/mtproto-tls-server