Using nginx as a reverse proxy with long connections enabled, the CWMP (CPE WAN Management Protocol) logs show “invalid session”.
When only a single device is connected, it works fine, but concurrency leads to “invalid session” errors. I’ve traced the code and found that the context is bound to the socket. Long connections between nginx and CWMP seem to be managed through a connection pool. When connections are idle, they can be assigned to other devices, leading to context mix-ups.
If long connections aren’t enabled, digest authentication fails to retrieve the corresponding token, resulting in unsuccessful authentication.
Do you have any elegant nginx configuration to share, or any other solutions?
I think the general recommendation is to not proxy the cwmp traffic because of these kinds of issues. What are the reasons why you want to proxy the cwmp traffic?
We usually don’t want the external network traffic to be directly connected to our system, and we need to identify the connection to avoid malicious attacks. Only valid requests are forwarded to CWMP
The above configuration requires support for the WebSocket protocol to function properly. However, it cannot guarantee a keep-alive connection from Nginx to the CWMP service. Therefore, even when using digest authentication, authentication fails.
Currently, after reading the code, the reason for the failure is clear (the context and socket are deeply bound). However, I cannot find a method in Nginx to allow the client to exclusively occupy the socket connection from Nginx to CWMP. Perhaps I need to switch to a different proxy software?
Can this Nginx reverse proxy be used as a load balancer as well by assigning multiple backend servers? and Do we have to have sticky sessions or something as the tr069 needs to communicate with the same cwmp servers. Is there a defninitive guide on setting that up i.e. a nginx proxy also as a load balancer that can route requests to multiple cwmp backend servers?