CloudFlare Zero Trust + MQTT: does it work?

[lupoalberto12]

Hi! First: this isn't and Issues of the "ot-recorded" but I don't know where post and I though that ot-recorded is the base of this service.

My goals:

1. replace Google Maps with OwnTracks by importing the history of Google Maps locally
2. replace Google Maps with OwnTracks using the "Friends" feature
3. replace Google Maps with OwnTracks but without port forwarding
4. use OwnTracks as a tracker for Home Assistant

and I did this:

1. done (https://github.com/owntracks/recorder/issues/421)
2. done
3. I'm writing for this point

All my setup is running on docker, I'm using Mosquitto for the MQTT server and ot-recorder and owntracks-ui. This is the configuration for Mosquitto: persistence true persistence_location /config/data persistence_file mosquitto.db autosave_interval 1 autosave_on_changes true log_dest file /log/mosquitto.log password_file /config/passwd acl_file /config/acl allow_anonymous false log_dest syslog log_dest stdout connection_messages true log_timestamp true log_timestamp_format %Y-%m-%dT%H:%M:%S listener 3333 protocol mqtt cafile ca.crt certfile server.crt keyfile server.key require_certificate true use_identity_as_username true and thi for ot-recorder: OTR_STORAGEDIR="/store" OTR_HOST="mosquitto" OTR_PORT=3333 OTR_USER="user" OTR_CLIENTID="OwnTracks_Record" OTR_TOPICS="owntracks/#" OTR_HTTPHOST="0.0.0.0/0" OTR_HTTPPORT="8883" OTR_CAFILE="/config/certs/ca.crt" OTR_CAPATH="/config/certs/" OTR_CERTFILE="/config/certs/ot.crt" OTR_KEYFILE="/config/certs/ot.key" OTR_SERVERLABEL="OwnTracks" OTR_HTTPLOGDIR="/log"

Now, I don't want to open and forward the port 3333 so I configured a Zero Trust Tunnel on CloudFlare, that I have already used in other project. So, I create a tunnel with Service in HTTP point to the docker + 3333 (http://192.168.x.x:3333) and it doesn't work. Needless to say, it works fine on the local network.

Reading the documentation, I tried also with TCP protocol (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/local-management/configuration-file/) but it didn't change, but I found this: https://community.cloudflare.com/t/mqtt-trough-cloudflare-tunnel/503599/13

I change the mosquitto configuration to "protocol mqtt" in "protocol websockets" and:

1. it still doesn't work
2. ot-recorder cannot connect to mqtt server

So, even if reluctantly, I started to read for HTTP configuration and, I didn't understand if it the same or not (and I'm not the only one: https://github.com/owntracks/booklet/issues/61). Maybe, with HTTP configuration, I cannot use anymore the "Friends function" that it it a my goals.

So, questions:

1. Has anyone used this service with a CloudFlare ZeroTrust tunnel or can you recommend a similar service?
2. If I have to use the "websockets" protocol, how should I change the configuration of "ot-recorder"?
3. Is it true that the "Friends" feature doesn't work with the HTTP protocol?

Thank you so much. Bye.

[jpmens]

I think you are trying to put MQTT over HTTP and that won't work. Also note that ot-recorder doesn't support websockets. Unfortunately the combination you're attempting is doomed.

I would recommend you look at our Quicksetup which is documented in the Booklet.

[lupoalberto12]

I think you are trying to put MQTT over HTTP and that won't work. Also note that ot-recorder doesn't support websockets. Unfortunately the combination you're attempting is doomed.

Thank you jpmens. I suspected it but I needed a confirmation.

So, is the solution open the port or use a remote MQTT server?

Thanks. Regards.

[jpmens]

I cannot specifically help you with cloudflare products.

[lupoalberto12]

I cannot specifically help you with cloudflare products.

Hi Jpmens. My question was: how did you do? Have you opened the door and forwarded it?

Thanks.

[jpmens]

There are numerous methods you could employ from situating the broker somewhere outside your infrastructure, redirecting TCP ports, using VPNs, etc.

[lupoalberto12]

There are numerous methods you could employ from situating the broker somewhere outside your infrastructure, redirecting TCP ports, using VPNs, etc.

At the end I opened and forward the port. Thanks.