# Wss configuration for nginx reverse proxy

**URL:** <https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032>\
**Category:** Uncategorized\
**Created:** [February 22, 2022, 1:45pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032 "2022-02-22T13:45:25Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![prasad9920](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@prasad9920](https://community.hivemq.com/u/prasad9920)\
**Post date:** [February 22, 2022, 1:45pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/1 "2022-02-22T13:45:25Z")

</div>

Hi All,

Facing wss connection failed on nginx side. We are using nginx as reverse proxy. I searched on google it was showing required following config but after putting following config under stream it giving error as “nginx: [emerg] “location” directive is not allowed here in”. so I put same config under http section but getting another error as bind failed on 443.

```
    location /mqtt {
       access_log /wwwlogs/com.log;
       proxy_pass https://localhost:8084/mqtt;
       proxy_read_timeout 60s;
       proxy_set_header Host $host;
       proxy_set_header X-Real_IP $remote_addr;
       proxy_set_header X-Forwarded-for $remote_addr;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection 'Upgrade';
    }

```

Please anyone help me to fix this issue on nginx.

---

<div class="post-metadata">

**Author:** ![SShet](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@SShet](https://community.hivemq.com/u/SShet)\
**Post date:** [February 24, 2022, 2:26pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/2 "2022-02-24T14:26:38Z")

</div>

Hello Prasad,

Welcome to Hivemq community Forum.

To enable reverse proxy for web-sockets you will need to put your configuration inside **http** block.

Following are the minimum required configs to enable websockets for Hivemq broker.

```auto
server {
        listen 8001; #please make sure port is not used by any other process
        server_name localhost; # use your server name or ip

        location /mqtt {
            proxy_pass "http://localhost:8000/mqtt"; #use the port you have actually configured in your Hivemq config.xml.
            proxy_connect_timeout 1s;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
         }
   
    }

```

Of course you can add SSL/TLS Termination configurations to same server block.  
Also if you want to forward real ip to broker you will need to have [proxy protocol feature](https://www.hivemq.com/docs/hivemq/4.7/user-guide/proxy-protocol.html) enabled. This is a HiveMQ Enterprise Edition feature.

I hope this helps.

Kind regards,  
Sheetal from the HiveMQ Team

---

<div class="post-metadata">

**Author:** ![prasad9920](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@prasad9920](https://community.hivemq.com/u/prasad9920)\
**Post date:** [February 24, 2022, 2:57pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/3 "2022-02-24T14:57:58Z")

</div>

Hi Sheetal,

Thanks for quick reply.

I configured the same config under http block it giving bind error on port 443.

Actually on nginx stream block is configured and when I put above config in server section of stream it showing error as location is not allowed in stream so I google it and put it under http block but it was giving bind 443.

I think nginx stream and http both want to bind on port 443 and this is making issue.

---

<div class="post-metadata">

**Author:** ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)\
**Post date:** [February 25, 2022, 9:15am UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/4 "2022-02-25T09:15:18Z")

</div>

Hi Prasad,

could you please confirm exact HiveMQ version and flavour you are running?

thanks!  
Dasha from HiveMQ Team

---

<div class="post-metadata">

**Author:** ![prasad9920](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@prasad9920](https://community.hivemq.com/u/prasad9920)\
**Post date:** [February 25, 2022, 9:53am UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/5 "2022-02-25T09:53:58Z")

</div>

Hi Daria,

hivmq version 3.3.3 and centos 7.9

---

<div class="post-metadata">

**Author:** ![SShet](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@SShet](https://community.hivemq.com/u/SShet)\
**Post date:** [February 25, 2022, 11:10am UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/6 "2022-02-25T11:10:24Z")

</div>

Hello Prasad,

Thanks for reply. HiveMQ 3.3.3 is already reached end of life. We would recommend updating to the supported [hivemq version](https://hivemq.atlassian.net/servicedesk/customer/portal/1/article/831029609?src=1346931369).

It is not supported to listen on same port (443) in http and stream hence you are getting error with binding port. To resolve issue you will need to change port either for stream block or http block. We would recommend to use 8883 instead of 443 port for stream block.

Kind regards,  
Sheetal

---

<div class="post-metadata">

**Author:** ![prasad9920](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@prasad9920](https://community.hivemq.com/u/prasad9920)\
**Post date:** [February 25, 2022, 12:10pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/7 "2022-02-25T12:10:18Z")

</div>

Hi Sheetal,

Thanks for quick response. My nginx stream config as under and I have doubt, do we have /mqtt is directory on hivemq installation location? because we are putting config on nginx to location search under /mqtt. My hivemq server running on 8883 I am using nginx as reverse proxy but due do wss issue I am stuck.

server {  
listen 443 ssl;  
server\_name servername;

ssl\_certificate certificate-path;  
ssl\_certificate\_key key-file-path;

location /mqtt/ {  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host $host;  
proxy\_pass [https://127.0.0.1:8883/mqtt/;](https://127.0.0.1:8883/mqtt/;)  
proxy\_ssl\_certificate certificate-path;  
proxy\_ssl\_certificate\_key key-file-path;  
proxy\_http\_version 1.1;  
proxy\_set\_header Upgrade $http\_upgrade;  
proxy\_set\_header Connection “upgrade”;  
}

---

<div class="post-metadata">

**Author:** ![SShet](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@SShet](https://community.hivemq.com/u/SShet)\
**Post date:** [February 25, 2022, 2:43pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/8 "2022-02-25T14:43:23Z")

</div>

Hello @prasad9920 ,

Can you please share your Hivemq config.xml as well as full Nginx configs. Also please share your full error what you observe with Nginx.

Kind regards  
Sheetal from the HiveMQ Team

---

<div class="post-metadata">

**Author:** ![prasad9920](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@prasad9920](https://community.hivemq.com/u/prasad9920)\
**Post date:** [February 25, 2022, 2:54pm UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/9 "2022-02-25T14:54:38Z")

</div>

Hi Sheetal,

Thanks for help my bad I was putting wrong port 8883 it is actually 8885. After that change it is working properly under http block.

Following is the config for http section now. Keeping for reference

upstream broker1 {  
server 192.168.10.35:8885;  
}  
server {  
listen 443 ssl;  
listen [::]:443 ssl;  
ssl\_certificate server-cert;  
ssl\_certificate\_key cert-key-file;

```
            location /mqtt {
                    proxy_pass http://broker1;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Host $host;
                    proxy_read_timeout 300s;
                    proxy_connect_timeout 75s;
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection "upgrade";
            }

```

Thanks for help Sheetal. Sorry for trouble.

---

<div class="post-metadata">

**Author:** ![prasad9920](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@prasad9920](https://community.hivemq.com/u/prasad9920)\
**Post date:** [March 7, 2022, 8:00am UTC](https://community.hivemq.com/t/wss-configuration-for-nginx-reverse-proxy/1032/10 "2022-03-07T08:00:13Z")

</div>

Hi Sheetal,

is it possible to share haproxy config for hivemq?

Regards,  
Prasad