Jitsi Meet mit WAF

I'm running jitsi behind utm WAF without issue.  I use the docker-compose version. 

Wildcard cert, https & redirect.  Had no issues.

Interesting. Http/htttps handled by WAF? Which ports did you redirect? 10000/UDP? What happens if a client in an restricted network, where 10000/UDP outgoing is blocked, joins a meeting?

not having issues with 10000udp, it all just seems to work over https.  I seriously did almost nothing to get it up and running other than the basic config for the docker-compose .env and yaml 

First of all, thanks for your insights, this might help others.

For sure your configuration will work if 10000/UDP isn't blocked in client's networks. Unfortunately most corperate networks are very restrictive and block outgoing UDP connections.

As far as I know Jitsi tries to fall back to 443/TCP is 10000/UDP is blocked. Then clients will use just a TCP connection, but no HTTPS so WAF won't be able to handle this traffic. Also I would guess, that there will also be a problem at the client side if a client's HTTPS traffic is handled by a web proxy if 10000/UDP is blocked.

Is your Jitsi only used in your internal network or are there also external clients? Do you additionally use an external TURN server?

External, works fine connected through cellular data on my android phone as well as on my personal internet at my house.  it hasn't been stress tested with dozen of clients connected, but did test with a small number without issue.  Still working on branding and authentication with lobby before fully roll it out, but basics seem to be fine.

Hello,

ok new information.

since some weeks i tryd again. 

Realwebservers i add 

Server Meeting-443 with port 4444

ans Server Meeting-4443 with port 4443

Virtual Servers connect to Meeting-443 - with Port 443

an Virtual Server connect to Meeting-4443 with port 4443

i also editet the NGX:

/etc/nginx/sites-enabled/meeting.domain.net

FROM

server {
listen 443 ssl;
listen [::]:443 ssl;

TO

server {
listen 4444 ssl http2;
listen [::]:4444 ssl http2;

it worked .. 

Your android phone does't block 10000/UDP, neither does your personal internet connection I guess. Try to setup your home computer's firewall to block 10000/UDP for testing purposes. Video/audio won't work anymore.

If you only want to changeyour logo you could see here: https://community.jitsi.org/t/branding-screen-view/30962

For authentication you can take a look into Jitsi's handbook: https://jitsi.github.io/handbook/docs/devops-guide/secure-domain

Sounds great. Again my question here: did you try this with external clients which have outgoing traffic via 10000/UDP blocked? If so, did they work as well?

i testet with goverment Firewalls/netwoork -

without 10000/UDP it doesent work!

:-(

:-(