Deploying the reverse proxy and TURN server using an OVA template

The IP address of the appliance.

Defaults to a value suggested by DHCP if available.

The network mask for the appliance.

Defaults to a value suggested by DHCP if available.

The IP address of the appliance's default gateway.

Now skip to step 2 DNS servers.

This step only applies if 2 or more network interfaces are detected on the underlying virtual machine. In the example deployment scenario shown above, this step would not be presented.

Values: yes/no

Default: no

Enter a NIC from the printed list (e.g. nic0) to be used as the (single) interface for the appliance.

Then proceed as for a single NIC deployment above (step 1.1).

Enter the name of the internal-facing network interface.

Values: expects a NIC from the printed list (e.g. nic0).

Enter the name of the external-facing network interface.

It automatically fills out the answer if one NIC is left, otherwise it expects a NIC from the list which has not already been chosen (e.g. nic1).

The IP address of the internal interface of the appliance (e.g. 10.44.0.5).

Defaults to a value suggested by DHCP if available.

The network mask for the internal interface (e.g. 255.255.0.0)

Defaults to a value suggested by DHCP if available.

Values: yes/no

Default: no

If "yes" you are prompted with:

• "Network IP Address?" - enter a base IP address (e.g. 192.168.0.0). You can also supply an address in CIDR format (e.g. 192.168.0.0/16), in which case the following netmask question is skipped.
• "Network Netmask?" - enter a netmask (e.g. 255.255.0.0).
• "Via IP Address?" - enter an IP address that is accessible from the interface's IP/netmask (e.g. 10.44.0.1).
• "Add another custom network route for <internal NIC>?" - enter "yes" to add another route (jumps back to "Network IP Address?"), or "no" to continue on to the next step.

If you are rerunning the wizard, and you previously entered some custom routes, the previous routes are listed and you are asked "Use these default values?" instead. Reply "yes" (default) to reuse the previous routes, or "no" to change the routes via this step.

The IP address of the external interface of the appliance (e.g. 198.51.100.130).

Defaults to a value suggested by DHCP if available.

The network mask for the external interface (e.g. 255.255.0.0)

Defaults to a value suggested by DHCP if available.

<list of default DNS servers found>

Use these default values?

This step only applies if DNS servers were saved from a previous run or detected from DHCP.

Values: yes/no

Default: yes

This step only applies if not using the default DNS servers.

Enter an IP address (e.g. 10.44.0.9) or an empty line.

The question is repeated ("DNS server 2" etc) until an empty line is received. At least one DNS server must be configured.

DNS is mainly used to resolve the hostnames of NTP servers.

The hostname of the appliance.

The hostname and domain (configured in the next step) must match the actual DNS name by which the appliance will be addressed.

The domain suffix of the appliance. This means that if the host name in the previous step was configured as proxy, that the full FQDN of this appliance is proxy.example.com.

Defaults to a value suggested by DHCP if available.

If a custom SSL certificate is created for the reverse proxy, this FQDN needs to match the Subject Name and Subject Alternative Name of the SSL certificate. For more information, see Replacing the default SSL certificate on the reverse proxy.

<list of default NTP servers>

Use these default values?

We recommend that at least three NTP servers are used to ensure proper NTP time synchronization.

The default list of NTP servers is 0.pexip.pool.ntp.org, 1.pexip.pool.ntp.org, 2.pexip.pool.ntp.org.

Values: yes/no

Default: yes

This step only applies if not using the default NTP servers.

Enter an IP address (e.g. 10.44.0.5), an FQDN (e.g. 0.pexip.pool.ntp.org), or an empty line.

The question is repeated ("NTP server 2" etc) until an empty line is received. At least one NTP server must be configured.

This step determines if the reverse proxy functionality is enabled.

Values: yes/no

Default: yes

If "no", skip to step 6 TURN server.

Specify the Conferencing Nodes that will receive the proxied HTTPS (signaling) requests.

Enter the IP address of a Pexip Conferencing Node or an empty line when finished.

We recommend that these nodes are configured as Transcoding Conferencing Nodes.

The question is repeated ("Conferencing Node 2" etc) until an empty line is received. At least one Conferencing Node must be configured.

If you are rerunning the wizard, and you previously entered some node addresses, the previous addresses are listed and you are asked "Use these default values?" instead. Reply "yes" (default) to reuse the previous addresses, or "no" to change the addresses via this step.

Content-Security-Policy is an HTTP header that provides enhanced security against cross-site scripting attacks.

Values: yes/no

Default: yes

Enter 'yes' to enable Content Security Policy. This is recommended if you are not using optional advanced features such as plugins for Connect app, externally-hosted branding, or externally-hosted pexrtc.js in your Pexip deployment.

Enter 'no' for best compatibility with these optional advanced features, otherwise we recommend that you enable this option.

If you answered "no" to "Enable web reverse proxy?", this question is skipped and the TURN server is enabled by default. In our example deployment, this question is asked and the answer is "yes".

Values: yes/no

Default: yes

This only applies if you answered "no" to "Enable web reverse proxy?". It allows you to configure the TURN server to listen on port 443 instead of 3478. In our example deployment the answer is "no". See Configuring the TURN server for TCP TURN relay for more information.

Values: yes/no

Default: no

The TURN server can either be configured using a restricted configuration mode or a permissive mode. Permissive mode is required for direct media configuration and it requires the TURN device to be deployed externally (e.g. in a DMZ) as it allows relaying of traffic to any IP address. Permissive mode also requires the use of time-limited credentials as opposed to a static username/password. If you are not using this TURN server for direct media then restricted mode should typically be used (where media connectivity is restricted to the specified Conferencing Nodes for extra security).

Values: yes/no

Default: yes

If "no", skip to step 6.7.

This only applies if using restricted mode.

The username and password are the credentials you must use when configuring Pexip Infinity with the access details for this TURN server.

A username must be entered.

This only applies if using restricted mode.

A password must be entered.

If you subsequently rerun the installation wizard you must resupply this password.

This only applies if using restricted mode.

Specify the addresses of the Conferencing Nodes that will use this TURN server for media relay.

Only the addresses specified here will be allowed (safelisted) to communicate with the TURN server over UDP/3478.

Enter the IP address of a Pexip Conferencing Node or an empty line when finished.

The question is repeated ("Conferencing Node 2" etc) until an empty line is received. At least one Conferencing Node must be configured.

This defaults to the list provided for the IP Address of signaling Conferencing Nodes step, if that question was asked. If you are rerunning the wizard, and you previously entered some node addresses, the previous addresses are listed and you are asked "Use these default values?" instead. Reply "yes" (default) to reuse the previous addresses, or "no" to change the addresses via this step.

If you later add more Conferencing Nodes to your platform, and those nodes need to use this TURN server, you will need to rerun the wizard and add the addresses of those new nodes.

This only applies if using permissive mode.

In permissive mode, a TURN secret key must be used for authentication.

You can enter your own key, or just press Enter and it will generate (and display) a key for you.

When configuring the TURN server in Pexip Infinity, use a TURN server type of Time-limited credentials (instead of a username and password) and enter the key as the Shared secret.

This allows the enterprise's management network to access this host over SSH.

Values: yes/no

Default: yes

If you are rerunning the wizard, and you previously entered some management networks, the previous networks are listed and you are asked "Use these default values?" instead. Reply "yes" (default) to reuse the previous networks, or "no" to change the networks via this step.

If "no" skip to step 8 Fail2ban. Note that the SSH service is disabled if no management networks are configured.

Fail2ban is an intrusion prevention framework that can protect the reverse proxy from brute-force attacks on PIN-protected conferences.

Values: yes/no

Default: no

See Enabling fail2ban on the reverse proxy for more information.

Enables SNMPv2c read only access.

Values: yes/no

Default: no

If "no", skip to step 10 certificates.

The SNMP trap community name.

Default: public

The SSL certificate is used when accessing conferencing services.

Values: yes/no

Default: yes

See Replacing the default SSL certificate on the reverse proxy for instructions on how to upload your own TLS certificate.

If you have uploaded your own SSL certificate and do not want it to be replaced, ensure that you answer "no" to this option.

The SSH certificate is used when connecting over SSH for maintenance tasks.

Values: yes/no

Default: yes