【FreeSwitch开发实践】freeswitch ngnix wss反向代理及jssip修改(wss连不上问题解决)

---

前言

首先freeswitch支持UDP、TCP、WS(websocket)、WSS方式进行注册，而反向代理是指通过nginx配置，通过WSS的方式连接WS，这样使得freeswitch连接对外是加密的；当然freeswitch本身是支持WSS的， 用ngnix一般除了反向代理，更多的是作负载均衡，这里只介绍反向代理的部分。

---

一、准备工作

首先要把freeswitch配置好，5066端口是通的；另外准备测试工具，这里用的是jssip3.0.3; 再就是安装好ngnix。

1. freeswitch 1.10.7 端口5066端口
2. jssip3.0.3
3. ngnix 1.22.0
4. centos 7.6

二、ngnix配置

ngnix配置包括部分， 证书配置和反向代理配置。

证书配置

listen       443 ssl;
#server_name  localhost;
server_name freeswitch123.test.com.cn;
ssl_certificate cert/test.com.cn.crt;
ssl_certificate_key cert/test.com.cn.key;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

反向代理配置

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}
upstream 95f5024653ff52061359b6086677cf24 {
	server 10.0.8.23:5066  weight=10 max_fails=2 fail_timeout=6s;
}
location /{
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection $connection_upgrade;
	proxy_read_timeout 86400s;
	proxy_pass http://95f5024653ff52061359b6086677cf24;
}

完整配置

user  root;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;
    upstream 95f5024653ff52061359b6086677cf24 {
    	server 10.0.8.23:5066  weight=10 max_fails=2 fail_timeout=6s;
    }

	log_format  access  '$remote_addr - $remote_user [$time_local] "$request" '
             '$status $body_bytes_sent "$http_referer" '
             '"$http_user_agent" $http_x_forwarded_for "$upstream_addr" "$upstream_response_time" $request_time $content_length';

	map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }
    server {
        listen       80;
        listen       443 ssl;
        #server_name  localhost;
		server_name freeswitch123.test.com.cn;
		ssl_certificate cert/test.com.cn.crt;
		ssl_certificate_key cert/test.com.cn.key;
		ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
		ssl_prefer_server_ciphers on;

		#access_log /data/nginx/logs/freeswitch82.autohome.com.cnaccess.log access;

		keepalive_timeout 65;
        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location /{
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 86400s;
			proxy_pass http://95f5024653ff52061359b6086677cf24;
        }
        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}

二、jssip修改

由于是反向代理是以wss的方式连接websocket，直接以wss连接freeswitch则会出现ws连接成功，则sip指令里用的是wss方式，所以要把jssip中wss的sip指令改成ws。
修改jssip-3.0.3.js如下：

三、测试效果

其中：
Server Websocket：wss://freeswitch123.test.com.cn:443
Server SIP: freeswitch123.test.com.cn
freeswitch123.test.com.cn是 freeswitch服务的域名
端口443是ngnix配置ssl端口

四、注意

在jssip工具中如果不进行修改，会出现如下错误：

js控制台有如下错误：

可以看出wss连接成功了，但sip协议注册失败了。
所以解决办法就是修改jssip中wss连接时对应的sip协议要改成WS。

总结

以上就是ngnix配置wss反向代理的内容：

1. ngnix的配置，包括ssl证书反向代理配置；
2. jssip工具对反向代理支持的配置；
3. 注意事项，不按步骤2修改会发生的错误。
   以上。

配置及jssip下载链接：https://download.csdn.net/download/xxm524/85864701