Cloudflare Developers•6d ago

How to configure DNS Websocket Proxy

So far I have a webapp site where is secured under the DNS proxy. All good. Till now I have to add websockets. We opted to use Laravel Reverb. So to not expose the server IP, we also want to use the DNS proxy for the Laravel Reverb nginx site record. But then, when I do it, websockets just stop working. If I remove the proxy DNS for the Laravel Reverb record, it works again. Have you ever faced this issue? How would you fix it?

41 Replies

ericmpOP•6d ago

Update: I had the websocket port open at 6000, changed it, now is on 9502 but still doesn't work

Laudian•6d ago

Neither of those ports is supported by Cloudflare. I'd recommend keeping Websocket requests on port 443 and then use Origin rules to change websockets to a different origin port. Also, did you enable Websockets in the Cloudflare dashboard?

ericmpOP•6d ago

i mean, yes, i use 443 for the websockets but then it redirects to the actual port. is that how it should work, right? no, i havent enabled it. i already saw it checked and i can share u the nginx site configs if needed

gamerboy•5d ago

use different port then like 2053 2083 2087 2096 8443 even for internal then, try and see if that works

ericmpOP•5d ago

i tried the 2053, it doesnt work if the DNS proxy is enabled if the DNS proxy is disabled, it works with that port

Laudian•5d ago

What exactly do you mean by redirect?

ericmpOP•5d ago

i chose wrong words. sorry for that. i meant, for the websocket nginx site, i listen on 443, but then, internally, i do "proxy_pass" to the port 2053 im quite new on configuring servers n stuff, so ill try to be more concise in next messages

Laudian•5d ago

All good. If you use nginx do proxy WS requests to the correct port, there shouldn't be any problem.

ericmpOP•5d ago

there is no problem only if i dont use the cloudflare dns proxy when i use it, then the websockets doesnt work anymore i get the typical webtools console msg saying i cannot connect to the websocket

Laudian•5d ago

Do you have any Rules on Cloudflare? Do you use WS or WSS?

ericmpOP•5d ago

im trying to figure out if i use ws or wss - at the moment i found in the codebase: enabledTransports: ['ws', 'wss'], and for the rules on cloudflare, in which section should i search for those rules?

Laudian•5d ago

Rules are in the Rules section 😉 Also, which SSL mode do you use? It should be Full (Strict)

ericmpOP•5d ago

id say i have no rules then, cuz never entered this section before yep, ive got: SSL/TLS encryption Current encryption mode: Full (strict)

Laudian•5d ago

Can't you see in the dev console whether the address is ws or wss?

ericmpOP•5d ago

found it - wss wss://websocket.mydomain.com/app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false (the domain name is an example)

Laudian•5d ago

It's always hard to debug issues like this without actually being able to test. Do you see connection attempts in your serverlogs?

ericmpOP•5d ago

ive got a reverb.log file, but it doesnt show any errors: tail: INFO Stopping server on 0.0.0.0:2053.
INFO Starting server on 0.0.0.0:2053 (websocket.mydomain.com). this in the backend in frontend, devtools console:

WebSocket connection to 'wss://websocket.mydomain.com/app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false' failed: 

createWebSocket    @    app-8XLNMUSg.js:13
getSocket    @    app-8XLNMUSg.js:12
connect    @    app-8XLNMUSg.js:12
v    @    app-8XLNMUSg.js:13
emit    @    app-8XLNMUSg.js:12
changeState    @    app-8XLNMUSg.js:12
Xr    @    app-8XLNMUSg.js:12
connect    @    app-8XLNMUSg.js:13
tryStrategy    @    app-8XLNMUSg.js:12
C    @    app-8XLNMUSg.js:12
(anonymous)    @    app-8XLNMUSg.js:12
(anonymous)    @    app-8XLNMUSg.js:12
(anonymous)    @    app-8XLNMUSg.js:12

WebSocket connection to 'wss://websocket.mydomain.com/app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false' failed: 

createWebSocket    @    app-8XLNMUSg.js:13
getSocket    @    app-8XLNMUSg.js:12
connect    @    app-8XLNMUSg.js:12
v    @    app-8XLNMUSg.js:13
emit    @    app-8XLNMUSg.js:12
changeState    @    app-8XLNMUSg.js:12
Xr    @    app-8XLNMUSg.js:12
connect    @    app-8XLNMUSg.js:13
tryStrategy    @    app-8XLNMUSg.js:12
C    @    app-8XLNMUSg.js:12
(anonymous)    @    app-8XLNMUSg.js:12
(anonymous)    @    app-8XLNMUSg.js:12
(anonymous)    @    app-8XLNMUSg.js:12

hard to debug it, not sure where to look more, lets see if i can get more logs

Laudian•5d ago

I was thinking more of the nginx logs, since that's where the requests go first

ericmpOP•5d ago

last log on file /var/log/nginx/error.log:

2025/02/27 09:23:29 [error] 2467118#2467118: *59 connect() failed (111: Unknown error) while connecting to upstream, client: (hiddenip)), server: websocket.mydomain.com, request: "GET /app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false HTTP/1.1", upstream: "http://0.0.0.0:2053/app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false", host: "websocket.mydomain.com"

2025/02/27 09:23:29 [error] 2467118#2467118: *59 connect() failed (111: Unknown error) while connecting to upstream, client: (hiddenip)), server: websocket.mydomain.com, request: "GET /app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false HTTP/1.1", upstream: "http://0.0.0.0:2053/app/0p104f4dfxpgb8x7j?protocol=7&client=js&version=8.4.0-rc2&flash=false", host: "websocket.mydomain.com"

4mins ago

Laudian•5d ago

That does seem like an issue with nginx connecting to your backend

ericmpOP•5d ago

okay, so if i enable cloudflare dns proxy i have to change the nginx site config?

Laudian•5d ago

Can you share the nginx config? You shouldn't need to, unless you do something in nginx that isn't compatible by default

ericmpOP•5d ago

so if i shouldnt need to, then i prolly have it configured well, since if i just disable the cloudlfare dns proxy, it just works, but yeah 1sec i share the site config /etc/nginx/sites-available/reverb.mysite.com.conf

server {
    server_name reverb.mysite.com;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        proxy_pass http://0.0.0.0:2053;
        # proxy_pass http://0.0.0.0:9502;
        # proxy_pass http://0.0.0.0:6000;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/reverb.mysite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/reverb.mysite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = reverb.mysite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name reverb.mysite.com;
    listen 80;
    return 404; # managed by Certbot
}

server {
    server_name reverb.mysite.com;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        proxy_pass http://0.0.0.0:2053;
        # proxy_pass http://0.0.0.0:9502;
        # proxy_pass http://0.0.0.0:6000;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/reverb.mysite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/reverb.mysite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = reverb.mysite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name reverb.mysite.com;
    listen 80;
    return 404; # managed by Certbot
}

im using certbot to handle ssl as u can see other configs, basic stuff i guess

Laudian•5d ago

previously, you said the subdomain was websocket., here it's reverb

ericmpOP•5d ago

sorry while trying to hide my real domain i mess it

Laudian•5d ago

proxy_pass http://0.0.0.0:2053; that's a bit weird.

ericmpOP•5d ago

is reverb

Laudian•5d ago

you shouldn't send traffic to 0.0.0.0 - is the backend on the same machine?

ericmpOP•5d ago

same machine

Laudian•5d ago

Then you should use 127.0.0.1 or localhost

ericmpOP•5d ago

would maybe this fix it? or u think there is more to fix?

Laudian•5d ago

I think that's definitely a potential issue, though I have no idea why enabling/disabling the proxy would have any effect on that

ericmpOP•4d ago

had to go :/, but im back (: , i tried to use 127.0.0.1 instead of 0.0.0.0 but same result now trying localhost btw why u say its a bit weird? having 0.0.0.0 is okay i guess, no? or u think its better to not use it? i dont know what should i try next, any ideas? idk how to debug it further

Laudian•4d ago

Have you tried changing your address from 0.0.0.0? Your logs show that nginx can't connect to the upstream, so you'll have to figure out why that is and why using Cloudflare would have an impact on that.

ericmpOP•4d ago

i tried to use 127.0.0.1 instead of 0.0.0.0, but same result

Laudian•4d ago

One more idea I have is that it has something to do with Cloudflares URL or Header normalization. Does your app depend on these being in some specific format?

ericmpOP•3d ago

im just using ascii chars, reverb.mysite.com. not sure if that answers the question, i struggled trying to understand it

Laudian•3d ago

Does your app need headers in upper case for example? All header going through Cloudflare would be in lower case. Things like that. Cloudflare also normalizes the URL if you didn't disable that.

ericmpOP•3d ago

no, it doesnt need it

Laudian•3d ago

Then I'm all out of ideas.

ericmpOP•3d ago

😫 dont worry, u already tried to help me a lot, and i appreciate it if at least i could debug it somehow, but that is the hard part, that idk how to follow any trace

Gaming

Programming

How to configure DNS Websocket Proxy

Did you find this page helpful?