MQTT: Troubleshooting

Setup and configuration
1

Hi,

We’re working on encrypting MQTT, but we’re encountering some challenges. Before encrypting, we made sure that it worked. On our web-interface we could see that our gateway would receive and transmit frames. Now, when we have configured MQTT, to be encrypted, it wont receive or transmit.

We have been looking at the menu/section of Gateway troubleshooting:

https://www.loraserver.io/guides/troubleshooting/gateway/

  • tcpdump can’t be installed on our kerlink gateway, so can’t check.
  • tcpdump on our server shows nothing
  • local_conf.json is 127.0.0.1 , 1700 , 1700
  • journalctl -f -n 100 -u lora-gateway-bridge - only shows following

22
Skærmbillede 2019-07-29 kl. 12.44.22.jpg2850×98 118 KB

  • ps aux | grep lora-gateway-bridge shows that it’s active
  • mosquitto_sub -v -t “gateway/#” - shows message:

gateway/{ID of gateway}/stats {"mac":"{ID of gateway}","time":"2019-07-29T10:57:48Z","rxPacketsReceived":1,"rxPacketsReceivedOK":0,"txPacketsReceived":0,"txPacketsEmitted":0,"customData":{"ip":"IP of gateway"}}

Kerlink Gateway

# Generic MQTT authentication.
[backend.mqtt.auth.generic]
# MQTT server (e.g. scheme://host:port where scheme is tcp, ssl or ws)
server="ssl://HOSTNAME:8883"

# CA certificate file (optional)
#
# Use this when setting up a secure connection (when server uses ssl://...)
# but the certificate used by the server is not trusted by any CA certificate
# on the server (e.g. when self generated).
ca_cert="/user/cert/ca.crt"

# mqtt TLS certificate file (optional)
tls_cert="/user/cert/client.crt"

# mqtt TLS key file (optional)
tls_key="/user/cert/client.key"

LoRa Gateway Bridge

# Generic MQTT authentication.
[integration.mqtt.auth.generic]
# MQTT server (e.g. scheme://host:port where scheme is tcp, ssl or ws)
server="ssl://HOSTNAME:8883"

# CA certificate file (optional)
#
# Use this when setting up a secure connection (when server uses ssl://...)
# but the certificate used by the server is not trusted by any CA certificate
# on the server (e.g. when self generated).
ca_cert="/etc/mosquitto/ca_certificates/certs/ca.crt"

# mqtt TLS certificate file (optional)
tls_cert="/etc/mosquitto/ca_certificates/certs/client.crt"

# mqtt TLS key file (optional)
tls_key="/etc/mosquitto/ca_certificates/certs/client.key"

LoRa App Server

# MQTT server (e.g. scheme://host:port where scheme is tcp, ssl or ws)
server="ssl://HOSTNAME:8883"

# CA certificate file (optional)
#
# Use this when setting up a secure connection (when server uses ssl://...)
# but the certificate used by the server is not trusted by any CA certificate
# on the server (e.g. when self generated).
ca_cert="etc/mosquitto/ca_certificates/certs/ca.crt"

# TLS certificate file (optional)
tls_cert="etc/mosquitto/ca_certificates/certs/client.crt"

# TLS key file (optional)
tls_key="etc/mosquitto/ca_certificates/certs/client.key"

LoRa server

# MQTT server (e.g. scheme://host:port where scheme is tcp, ssl or ws)
server="ssl://HOSTNAME:8883"

# CA certificate file (optional)
#
# Use this when setting up a secure connection (when server uses ssl://...)
# but the certificate used by the server is not trusted by any CA certificate
# on the server (e.g. when self generated).
ca_cert="etc/mosquitto/ca_certificates/certs/ca.crt"

# TLS certificate file (optional)
tls_cert="etc/mosquitto/ca_certificates/certs/client.crt"

# TLS key file (optional)
tls_key="etc/mosquitto/ca_certificates/certs/client.key"

MOSQUITTO BROKER

cafile /etc/mosquitto/ca_certificates/certs/ca.crt

# Path to the PEM encoded server certificate.
certfile /etc/mosquitto/ca_certificates/certs/server.crt

# Path to the PEM encoded keyfile.
keyfile /etc/mosquitto/ca_certificates/certs/server.key

tls_version tlsv1.2
2

Just checked journal for lora-gateway-bridge, and sometimes this message shows up:

40
Skærmbillede 2019-07-29 kl. 15.07.40.jpg3352×212 257 KB

But when restarting lora-gateway-bridge and then rebooting server, journal seems to work?

46
Skærmbillede 2019-07-29 kl. 15.10.46.png3084×150 124 KB

3

2 of your 3 MQTT configuration entries are missing the second slash in the URL. However, if that’s just a forum typo, the connection refused message on port 8883 indicates that you don’t have the MQTT server listening on that address, or that a firewall is blocking with a TCP reject.

4

Thanks for responding, @bconway.

It was just a bad forum copy of the MQTT configuration.

port 8883 is allowed in ufw and iptables, so that should not be a problem.

This is everything that’s written in Mosquitto.conf:

# =================================================================
# Default listener
# =================================================================

# Port to use for the default listener.
port 1883

# =================================================================
# Extra listeners
# =================================================================

# listener port-number [ip address/host name]
listener 8883

# -----------------------------------------------------------------
# Certificate based SSL/TLS support
# -----------------------------------------------------------------

cafile /etc/mosquitto/ca_certificates/certs/ca.crt

# Path to the PEM encoded server certificate.
certfile /etc/mosquitto/ca_certificates/certs/server.crt

# Path to the PEM encoded keyfile.
keyfile /etc/mosquitto/ca_certificates/certs/server.key

tls_version tlsv1.2

Does this seem right?