MQTT not working on tcp port 1883 and websocket port 9001 through tunnel

Zero Trust Cloudflare Tunnel
1

I am using Cloudflare tunnel since my IP is dynamic so I use tunnel service to bind my domain using cloudflared service installed in ubuntu.

MQTT works on my local network fine but when I try to use tunnel services as shown in code below, then MQTT does not work on tcp port 1883 and websocket port 9001 through cloudflared tunnel.
sample of my config file (please not other services are working so config works as a service in ubuntu except MQTT)

tunnel: xxx
credentials-file: /etc/cloudflared/xxx.json
originRequest:
  noTLSVerify: true
ingress:
  - hostname: abc.xyz.co
    #this service works
    service: http://192.168.1.101:80
    originRequest:
      noTLSVerify: true
  - hostname: mqtt.xyz.co
    #this service does not work
    service: tcp://192.168.1.101:1883
    originRequest:
      noTLSVerify: true
  - hostname: wsmqtt.xyz.co
    #this service does not work
    service: ws://192.168.1.101:9001
    originRequest:
      noTLSVerify: true
  - service: http_status:404
    originRequest:
      noTLSVerify: true

Please note, if I use mqtt on local network it is up and running listening on the same ports locally. for example mosquitto_sub -h 192.168.1.101 -p 1883 -u user -P pass -t "#" and similarly mosquitto_pub on same host and port for example mosquitto_pub -h 192.168.1.101 -p 1883 -u user -P pass -t "test" -m 1 are working.

I am not sure where am I going wrong, so please let me know what could be a possible solution or any workaround for the same.
Thank you.

1 Like
4

Try with client-side cloudflared acces …

The TCP ports are not forwarded straight, but rather encapsulated in L7 over HTTP2or3.

5

See https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/use_cases/ssh/#connect-to-ssh-server-with-cloudflared-access

6

hi, I looked at that option, but my use case is to give public access to the mqtt service like mosquitto[dot]org , hiveos or mqtt[dot]cool etc. So in this case it is not feasible to implement client side control of any sort for the whole internet. So this option might work for me only but for publicly available mqtt service this is not suitable.