Connect LoRa Gateway Bridge with a remote MQTT broker

Jim · November 1, 2017, 6:59pm

Hi Orne,
I deployed the LoRa server on an AWS instance back in the Spring.
Now I would like to test the Gateway Bridge by installing it on one of my Gateways.

I have been using the instructions here: https://docs.loraserver.io/lora-gateway-bridge/install/gateway/multitech/
as an example - since my Gateway is our Laird product and not a Multitech… (Our gateway product is an armv7)

The gateway binary runs fine - it’s the server side I need help with.

I’m not sure what I need to modify on the server if anything. I did try pointing to my server - and I’m not quite sure what port to specify.

I tried originally w/out a port - since I was specifying ssl://
time=“2017-11-01T19:16:25Z” level=error msg=“could not setup mqtt backend, retry in 2 seconds: Network Error : dial tcp: mi
ssing port in address xxxx.com”
time=“2017-11-01T19:16:27Z” level=info msg=“backend: connecting to mqtt broker” server=“ssl://xxxx.com”

I then tried specifying a port, 1883, and that didn’t work either:

time=“2017-11-01T19:17:27Z” level=info msg=“backend: connecting to mqtt broker” server=“ssl://XXXX.com:1883”
time=“2017-11-01T19:17:27Z” level=error msg=“could not setup mqtt backend, retry in 2 seconds: Network Error : read tcp 10.
#.#.#.#:50956->#.#.#.#:1883: read: connection reset by peer”

I originally created the server using the ansible playbook.

Assuming that I setup mosquitto insecurely - could you point me to the configuration files I need to modify on the server to enable it to work with SSL so I can use the bridge?
Or would it be simpler to just install a fresh server instance - in which case I’d need to advice on how to modify the default deployment files to setup the server properly.

thanks

Jim

brocaar · November 1, 2017, 7:40pm

What you need to do is configure the LoRa Gateway Bridge on your gateway so that it connects with your MQTT broker running on your AWS instance (LoRa Gateway Bridge does not connect to your LoRa Server instance directly). You might want to setup MQTT credentials to make sure that nobody else is able to connect to your MQTT broker (Mosquitto?).

Depending your MQTT broker installation supports TLS, you use the tcp:// or ssl:// prefix for the MQTT_SERVER / --mqtt-server configuration.

Jim · November 2, 2017, 12:17pm

Just to be clear, yes, I am using Mosquitto as the broker, since that is what “loraserver-setup” installs.

My question is, to be able to use TLS - is there any way to have it enabled during installation - i.e. as an option in the customized “inventory” file
So all of the components that utilize the broker will use the proper authentication from the start.

OR is the customization mentioned here:

https://docs.loraserver.io/install/mqtt-auth/

Supposed to be done AFTER the server has been installed?

A customer would like to use the bridge binary on our gateway to talk to an instance of the server securely, so I am trying to setup a server with a secure Mosquitto installation for testing against.

I am assuming I need to enable TLS on the broker AFTER installation - which will break everything trying to talk to it - until I configure those pieces also?

brocaar · November 2, 2017, 12:40pm

Currently this is not (yet) supported by the loraserver-setup scripts as an initial setup. Please note that adding TLS support does not have to break your installation, you can define an additional TLS listener, next to a non-TLS listener. See for example: https://www.digitalocean.com/community/tutorials/how-to-install-and-secure-the-mosquitto-mqtt-messaging-broker-on-ubuntu-16-04.

Jim · November 2, 2017, 6:21pm

OK,
that digital ocean link helped a LOT!

I have modified my Mosquitto install to now require usernames / passwords and then updated the “lora-app-server”, “lora-gateway-bridge” and “loraserver” configs to use them.
I verified that change worked fine.

Then I setup a dynamic dns alias for my AWS instance - and used “Let’s Encrypt” to create the certs - and configured Mosquitto to use them.

I tweaked my security configuration to disallow 1700 and allow 8883 instead.

On my Gateway, I fired up the bridge via:

./lora-gateway-bridge --mqtt-server “ssl://server:8883” --mqtt-username USERNAME --mqtt-password PASSWORD --log-level 5

And it said it connected to the mqtt broker - WooHoo!

Problem:

Client can’t join - and the only message I found in the log is this:

Nov 2 17:52:23 lora-app-server[1432]: 2017/11/02 17:52:23 http2: server: error reading preface from client x.x.x.x:55379: remote error: tls: unknown certificate authority

I’m not sure if this error is a co-incidence or actually relative.

I did do a local connection to the broker from the server instance, and I was able to see the “Join” messages are being received.

Example payload I saw go by:

“ACIiIhIRERERVbuQeKqqNBJmfqwAll8=”

(A great decoder: https://lorawan-packet-decoder-0ta6puiniaut.runkit.sh )

So I think I’m getting close - but not there yet.

Suggestions?

brocaar · November 2, 2017, 8:36pm

Would you be able to post a bit more logs, from both LoRa Server and LoRa App Server?

Jim · November 3, 2017, 2:59pm

OK,
I did manage to get the properly signed certificates working - I had moved onto trying to get self-signed certificates working and while doing that I stopped and started the broker and bridge (on gateway) a lot.

I then went back to the properly signed certs this morning - and it just worked.

I now have it working properly with both properly signed and self-signed certs.

I didn’t know there were logs other than /var/log/syslog - and of course /var/log/mosquitto/mosquitto.log…

Jim · November 3, 2017, 6:16pm

Is there a way to specify an IPv6 server address?

The current syntax: “ssl://address:port” doesn’t translate well if the address is in IPv6 notation…

brocaar · November 4, 2017, 9:26am

I haven’t tried that. This is the documentation available by the MQTT client: https://godoc.org/github.com/eclipse/paho.mqtt.golang#ClientOptions.AddBroker. This uses the net/url Parse function to parse the input. See: https://golang.org/pkg/net/url/#Parse.

Jim · November 6, 2017, 8:26pm

OK - I took a look at the syntax of the various functions - and it almost looks like you can represent an IPv6:Port schema via [IPv6Address]:Port
but I haven’t had time to test that yet.

My current local installation is a box that has two VMs each running a Vagrant install of the server.
On your advice - I then pointed their loraserver and lora-app-server MQTT configs to point to an external common MQTT broker.
(This was so my automated tests could point to one broker - and not have to subscribe to both)

Anyhow - I configured that external broker (Mosquitto) to be able to support the bridge on port 8883.
The bridge connects to this external broker nicely - but my LoRa client can’t join.
The bridge shows normal chit-chat going on between it and the semtech forwarder - but I haven’t seen any trace of the Join attempts inside the Vagrant VMs.

I tried checking for log entries other than in /var/log/syslog - specifically I checked:

/var/log/lora-app-server/ and there were no log files in there…

Ideas on how I can figure out what is breaking?

brocaar · November 7, 2017, 3:40pm

I’m afraid that this could be a networking config related issue. Not sure if I could be of any help here.

Praveen_Kumar_R · March 6, 2018, 1:43pm

@Jim @brocaar

Hello,

I am facing exactly the same issue.My lora server also hosted in aws instance.
lora gateway bridge installed in my gateway(risinghf model).

Log of lora-gateway-bridge(running in my gateway)

Mar 06 13:26:21 rhf2s008 systemd[1]: Started LoRa Gateway Bridge.
Mar 06 13:26:22 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:26:22Z" level=info msg="starting LoRa Gateway Bridge" docs="https://docs.loraserver.io/lora-gateway-bridge/" version=2.3.0
Mar 06 13:26:22 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:26:22Z" level=info msg="backend: TLS config is empty"
Mar 06 13:26:22 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:26:22Z" level=info msg="backend: connecting to mqtt broker" server="tcp://13.127.xy.z:1883"
Mar 06 13:26:22 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:26:22Z" level=info msg="gateway: starting gateway udp listener" addr="0.0.0.0:1700"
Mar 06 13:26:22 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:26:22Z" level=info msg="backend: connected to mqtt broker"
Mar 06 13:31:06 rhf2s008 systemd[1]: Stopping LoRa Gateway Bridge...
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:31:06Z" level=info msg="signal received" signal=terminated
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:31:06Z" level=warning msg="shutting down server"
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:31:06Z" level=info msg="gateway: closing gateway backend"
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[4002]: time="2018-03-06T13:31:06Z" level=info msg="gateway: handling last packets"
Mar 06 13:31:06 rhf2s008 systemd[1]: Starting LoRa Gateway Bridge...
Mar 06 13:31:06 rhf2s008 systemd[1]: Started LoRa Gateway Bridge.
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[6078]: time="2018-03-06T13:31:06Z" level=info msg="starting LoRa Gateway Bridge" docs="https://docs.loraserver.io/lora-gateway-bridge/" version=2.3.0
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[6078]: time="2018-03-06T13:31:06Z" level=info msg="backend: TLS config is empty"
Mar 06 13:31:06 rhf2s008 lora-gateway-bridge[6078]: time="2018-03-06T13:31:06Z" level=info msg="backend: connecting to mqtt broker" server="tcp://13.127.XY.Z:1883"
Mar 06 13:31:07 rhf2s008 lora-gateway-bridge[6078]: time="2018-03-06T13:31:07Z" level=info msg="gateway: starting gateway udp listener" addr="0.0.0.0:1700"
Mar 06 13:31:07 rhf2s008 lora-gateway-bridge[6078]: time="2018-03-06T13:31:07Z" level=info msg="backend: connected to mqtt broker"

packet forwarder is also running.

Can you advise on me these?
Why my data is not reaching aws instance?
Which settings i need to change?
If you need any other logs please let me know.
Since i am a beginner ,where exactly i need to enter my server IP in configurations?