Problem with Port 8448

[HassanMullah]

Hello everyone,

I'm trying my hand at self-hosting a matrix server for the first time. This should only be available to the family, i.e. we assume 1 to 10 people. Due to the limited performance, I have decided in favour of Dendrite.

My domain (we'll just use example.org as an example here) looks like this.

DNS entries:
Host = *
Type = A
Destination: The IP of the external provider where the domain example.org is located

Host = chat
Type = CNAME
Destination = FQDN from myFritz (a service from AVM (manufacturer of Fritzboxes), basically a DDNS service)

Host = matrix
Type = CNAME
Destination = as for chat

Host = element
Type = CNAME
Destination = as for chat

The IP behind the FQDN of the destination is the external IP of my router.

I have enabled the external ports 80 and 443 on the router for the internal IP 192...200. There is an Nginx Proxy Manager behind IP 200. The FQDN chat.example.org is also set up on this. When I call up https://chat.example.org, I get the It works! Dendrite 0.13.4+317b101 is running page.

Now to the problem. I am running the Matrix instance on an Ubuntu Server 22.04.3 LTS in an LXC container on Proxmox VE 8.0.9

Docker and Docker-Compose are running in this LXC, with which Dendrite is published.

Here is the output of docker ps:

matrix@matrix-lxc:~/docker/matrix$ docker ps | grep 8448
3aa6a894bd6f matrixdotorg/dendrite-monolith:latest "/usr/bin/dendrite" 21 hours ago Up 18 hours 0.0.0.0:8008->8008/tcp, :::8008->8008/tcp, 0.0.0.0:8448->8448/tcp, :::8448->8448/tcp matrix-monolith-1

Here is the output of ss -tulpn:

matrix@matrix-lxc:~/docker/matrix$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*
tcp LISTEN 0 128 127.0.0.1:6010 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:8008 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
tcp LISTEN 0 100 127.0.0.1:25 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:8448 0.0.0.0:*
tcp LISTEN 0 128 [::]:8008 [::]:*
tcp LISTEN 0 100 [::1]:25 [::]:*
tcp LISTEN 0 128 [::1]:6010 [::]:*
tcp LISTEN 0 4096 :22 :
tcp LISTEN 0 128 [::]:8448 [::]:

And last but not least the output of nmap for port 8008 and 8448:

matrix@matrix-lxc:~/docker/matrix$ nmap -p8008 localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2023-11-22 11:17 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00013s latency).
Other addresses for localhost (not scanned): ::1

PORT STATE SERVICE
8008/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds
matrix@matrix-lxc:~/docker/matrix$ nmap -p8448 localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2023-11-22 11:17 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000094s latency).
Other addresses for localhost (not scanned): ::1

PORT STATE SERVICE
8448/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

When I perform an external port test, 80 and 443 are open, 8448 is closed.

The Matrix Federation Tester returns the following

Get "https://185.*.*.135:8448/_matrix/key/v2/server": dial tcp 185...135:8448: connect: connection refused

I urgently need help to get the federation up and running.

Thank you very much

[S7evinK]

Did you set up delegation (can easily be done in Dendrite itself)? From the looks of it that is missing and the federation tester is trying port 8448 instead of 443.

So you'll need to change your Dendrite config to something like:

global:
   server_name: example.com # so you have a "clean" MXID like @alice:example.com
   well_known_server_name: matrix.example.com:443 # this is used by federation, which currently is using example.com:8448 and causing your issue
   well_known_client_name: https://chat.example.com

Also, as I don't know how Nginx Proxy Manager is configured: you'll likely only need to forward 80/443 to 8008 on Dendrite.

[HassanMullah]

Hi Till,

my dendrite.yaml looks like this:

The https://chat.example.org looks like this:

The Federationtester looks like this:

And die JSON Report looks like this:

Can you please explain to me exactly what should be routed in Nginx (or Nginx Proxy Manager - NPM for short) and how? It would also be important for me to know whether I need to open port 8448 on my router firewall at all. If so, only TCP or also UDP. Where does the external port 8448 then point internally? To the reverse proxy (i.e. the NPM = IP 200) or to the LXC from the matrix server = IP 204.

Kind regards

[S7evinK]

No need to open port 8448.
You only need to use the server_name configured in Dendrite in the federation tester, then it should be able to correctly figure out that matrix.example.com:443 is the correct way to connect.

Ports 80 and 443 should be pointed at the Nginx Proxy (.200), which handles matrix.example.com and forwards both ports to .204 (so, the LXC)

(And thinking about it, you don't even need the chat.example.com subdomain, you can just configure well_known_client_name: https://matrix.example.com, as it points to Dendrite, at least from my understanding, given it returns the "It works" page)

[HassanMullah]

I'm getting really desperate. Somehow I don't really understand the logic of the Federation Tester. Besides, there are simply far too many "solutions" on the Internet. Some write you have to open port 8448, you write "no port 8448 remains closed".

Is there anyone here who can simply tell me which value to enter in the Nginx Proxy Manager and which in dendrite.yaml?

Let's just assume that

example.org = IP 200.200.200.200

and

matrix.example.org = IP 185.185.185.185
federation.examle.org = IP 185.185.185.185
element.examle.org = IP 185.185.185.185

This can't be that difficult

[S7evinK]

So, my checklist with the information from the initial post and the screenshot post:

• dendrite.yaml
• NPM (assuming matrix.example.org is the same as chat.example.org)
• Federation tester - almost - just the wrong domain

So the only thing you probably need to do: Use example.org in the federation tester and not matrix.example.org and everything is good to go. (So, basically the value from dendrite.yaml -> global.server_name)

[HassanMullah]

Till is it right, that your are from germany? If yes, können wir dann vielleicht auf einem privaten Kanal weiter machen. Ich würde gerne die echten Daten Dir zeigen.

[HassanMullah]

Ich schreibe jetzt einfach mal auf deutsch weiter, in der Hoffnung Du kannst es lesen ;-)

Habe jetzt mir noch eine 2. Anleitung angeschaut und von dort folgendes übernommen. Ich verwende jetzt nur noch den Namen matrix.example.org (also kein chat, kein elemet, kein federation kein nur example.org)

Dann habe ich die Config im Nginx Proxy Manager so angepasst

Mit diesen Einstellung läuft der Federation Tester durch

Passt dass dann so?

[S7evinK]

Mehr oder weniger, jetzt würde jeder Benutzer z.B. so aussehen: @alice:matrix.example.org anstatt @alice:example.org - relativ unschön. Du kannst mir gerne eine DM (@s7evink:matrix.org) schicken, dann können wir das "schön" machen, wenn Du möchtest. :)

(Translation for non German speaking people: More or less, every user would now look like @alice:matrix.example.org instead of @alice:matrix.org, slightly ugly. Feel free to send me a DM, so we can clean this up if you want.)