MeshCentral not working for non-local devices

[felixtech-msp]

Server Info (please complete the following information):

• OS: Ubuntu 20.04.6 LTS
• Browser: Firefox
• RMM Version (as shown in top left of web UI): v0.18.2

Installation Method:

• Standard
• Standard with --insecure flag at install
• Docker

Agent Info (please complete the following information):

• Agent version (as shown in the 'Summary' tab of the agent from web UI): v2.7.0
• Agent OS: Windows 10 Pro

Describe the bug
For all agents it is impossible to take control, when those machines are not in the same network as the TRMM server.
When logging the requests with the Firefox developer console, the last thing which happens is a 101 Switching Protocols to wss://mesh.example.com/control.ashx. Then nothing more is done. This WebSocket frequently has a outgoing "action:ping" and an incoming "action:pong" going on, but the window stays blank. On top there is just the "TRMM Agent Status: online" indication.
For machines in the same network as the TRMM server it works as expected.
From the outside only port 443 is accessible to all 3 TRMM domains. As there are no other documented ports, I guess everything runs over port 443.

[silversword411]

Yes everything runs over 443.

I'm guessing you have a DNS/routing/proxy problem.

Are you using your own proxy? You'll need to add more technical details to troubleshoot further

[felixtech-msp]

Initially it was done with Cloudflare Tunnels. This never worked. Cloud configured tunnels don't support WS/WSS and locally configured tunnels are so buggy that it made no sense to attempt to troubleshoot that approach.
Therefore I have switched over to normal Cloudflare proxy relaying to our datacenter's Nginx ingress proxy. The TRMM integrated proxy is still in use and has valid certificates. WebSockets are turned on in Cloudflare for that domain.
On the ingress proxy (that's a Nginx Proxy Manager) there is Websocket support enabled for this subdomain.
It is not possible to get around this constellation of using the ingress proxy, as there aren't sufficient IP addresses available to have tons of stuff running all on port 443.
This exact configuration is used frequently in our infrastructure and works totally as expected without ever having any issues since we built this datacenter. So basically all traffic goes through Cloudflare and everything entering the datacenter goes through this Nginx Proxy Manager and the Mesh subdomain forwards to the TRMM server. The MeshCentral page is accessible from outside. Also the remote control of devices in the local network of the TRMM server works from an outside computer on the internet.

[silversword411]

So you're triple proxying...with CF a proxy that worked, broke for almost a year with no explanation, then started kinda working again.

You have a lot of complex testing in your future if you continue down this path.

[felixtech-msp]

The CF Tunnels has never done WS before. The CF Proxy has always worked with WS. We never had any issue using CF Proxy. Not that CF Tunnels and CF Proxy is something completely different. It is basically confirmed that CF Proxy + Nginx Ingress Proxy does work perfectly fine with WS and WSS.