websocket cannot work with F5 Networks

[fenfenxu]

Websocket cannot work when the my program running behind F5 Networks.

First, I'm not sure this is an issue of the socket.io, maybe the configuration of F5 is not correct.

The client can build the ws connection, but message connot be send to the server with the ws connection. After several seconds the ws connection receive close frame.

I debug the ws connection with chrome.

[crzidea]

Of cource. Websocket can't connect server behind proxy.

[fenfenxu]

Fixed, It works after the OPS team has modified the configuration of the F5.

[syl0735]

Because F5 will default protocol identified as http, so we need disable the http protocol,like this
when HTTP_REQUEST {
if { ([HTTP::uri] starts_with "/socket.io") } {
HTTP::disable
}
}

[fenfenxu]

@syl0735 Nice!

[thwi]

Just for anyone stumbling upon this issue in the future, the requirement to disable the HTTP profile only applies to BIG-IP version < 11.4.1. I upgraded to 11.4.1 and have a HTTP profile applied to the VIP serving my socket.io traffic :)

See this article for more detail: http://support.f5.com/kb/en-us/solutions/public/14000/700/sol14754.html

[marcosnils]

@thwi the link you provided states that for 11.4.0 should work. Did you try it with 11.4.0?? ir directly moved to 11.4.1?

My question is because I have 11.4.0 in my organization and websockets seems not to be working behind F5.

[thwi]

@marcosnils I skipped 11.4.0 and went directly to 11.4.1.

If you're still on 11.4.0, a simple iRule can be used to disable the HTTP profile just for websockets traffic (as mentioned above).

[john2exonets]

In F5 BIG-IP v11.4.x and below, you can just test the connection to see if it is a websocket or not using this iRule:

when HTTP_REQUEST {
  if { [string tolower [HTTP::header Upgrade]] contains "websocket" } {
    HTTP::disable
    log local0. ">>WebSocket from [IP::client_addr]"
  }
}

Add this iRule to an HTTP (port 80) Virtual Server that might get Websocket traffic. The BIG-IP HTTP Profile in versions before 11.4.1 don't recognize the "Upgrade" from HTTP to TCP, so the WS connection fails without this iRule in place.