Guidelines on Port Forwarding

## Scene

This feature is intended for scenarios where the management node has a public IP address, while the rendering nodes do not.

## Implementation Method

By deploying a custom proxy forwarding service, rendering nodes can expose their services to external networks through the proxy. This allows rendering nodes without public IP addresses to provide services normally.

## Deployment Method

- Linux Docker

## After Decompression

Use the `larkxr-center-docker` directory. Its structure is shown in the figure below.

Modify the `application.yaml` file under the `admin` directory by following the four steps indicated in the comments:

```yaml
# NAT Forwarding Proxy
nat-proxy:
  # Enable this when using NAT forwarding to solve the issue of lacking a public IP
  # 1. Set to true
  enable: true

# Operation mode: client/server
  # 2. Set to server mode
  mode: server

# LarkXR Management Node used with an independently deployed NAT service in server mode
  server-mode:
    # Configure the address of the NAT Server API, for example: http://192.168.0.6:8183
    # 3. Set the API address for NAT service interaction
    api-server-address: http://192.168.0.164:8183

# LarkXR Management Node as a NAT client mode (not applicable here)
  client-mode:
    # NAT Server IP or domain name
    server-host:
    server-port: 20001

# clientKey provided by NAT Server
    client-key:

# Turn Service:
  # The Windows version does not support Redis for persistent user information, while the Linux version does.
  # Therefore, if the Windows version enables forwarding service server mode and needs to dynamically create TURN users,
  # an additional Linux version of turnserver must be deployed.
  # If the Windows version is only used for forwarding WebRTC traffic, the built-in TURN service can be used
  # with fixed user information configured in turnserver.conf.
  ice:
    server:
      # 4. Set to true to enable the TURN service
      enable: true
```

## Modify `turnserver.conf`

When deploying in a containerized environment, the public IP address of the physical machine running TURN must be accessible over the internet.

Open the `turnserver.conf` file in the installation package and configure the external IP address:

```bash
# Due to network devices (such as routers and firewalls) performing NAT between internal and external networks,
# the TURN server cannot directly obtain its external IP address.
# Therefore, the external-ip parameter is used to specify the IP address visible on the public internet.
# If external-ip is not configured, the TURN server will attempt to use the default IP address.
# However, if the default address is invalid or inaccessible, a reliable TURN connection cannot be established.
# By configuring external-ip, the TURN server can correctly handle and forward network traffic.
# For example, use the public IP for cloud VM deployment, and the node IP for local container deployment.

# Set this to the external IP address of the physical machine
external-ip=192.168.0.164
```

## Start Services in Docker

```bash
sh start.sh
```

## Start Proxy Service

> Note: You must configure the IP whitelist for API access. For example, when starting with Docker, use the IP address of the `admin` container, which is typically `172.29.0.20`.

Run the following command to start the proxy service:

```bash
cd /opt/larkxr-center-docker/proxy
sh start.sh
```

## Add Forwarding Service

Access the management backend at `http://{ip}:8182`, then go to the **Port Forwarding Management** page.

After adding the relevant configuration, the initial status of the forwarding client will appear as **Offline**. Please note that the **public port** and **client key** will be used in the following steps.

## Configure Rendering Nodes

Modify the `application.properties` file to configure the center management node URL and the private IP address:

```properties
# Center management node URL
# It is usually recommended to configure this as the LarkXR gateway access address,
# for example: http://192.168.0.20:8181
pxy.admin-server.url=http://192.168.0.164:8181

# This machine's private IP address
pxy.host.local-ip=192.168.0.28
```

Modify the public IP address:

```properties
# This machine's public IP address
# Set this value when public access is required and the node has been assigned a public IP
# Change this to the public IP of the NAT service
pxy.host.public-ip=192.168.0.164
```

Modify the default port `10002`:

```properties
# Rendering server client connection port
# This should be the "public port" in the forwarding port configuration
pxy.render-server.listen-port=20006
```

Modify the forwarding proxy settings:

```properties
########### NAT Forwarding Proxy ###########

# Enable this when using NAT forwarding to solve the issue of lacking a public IP
pxy.nat-proxy.enable=true

# LarkXR management node as NAT client mode
# NAT Server IP or domain name
# Change this to the public IP of the NAT service
pxy.nat-proxy.client-mode.server-host=192.168.0.164
pxy.nat-proxy.client-mode.server-port=20001

# clientKey provided by NAT Server
# Use the "clientKey" from the forwarding port configuration
pxy.nat-proxy.client-mode.client-key=#######
```

Modify the ICE configuration:

```properties
# Example format: turn:47.94.38.44:19303
# TURN URI for the proxy forwarding service
# This service is deployed together with admin by default, and the default port is 13478
pxy.ice.server.uri=turn:192.168.0.164:13478

# Use the "clientId" from the forwarding port configuration
pxy.ice.server.username=1328310734890729472

# Use the "clientKey" from the forwarding port configuration
pxy.ice.server.password=b2f216b331ec4879846a70efdb6f3a43

# Set to 1 to force TURN usage
pxy.ice.transport=1
```

## Start Services

### Access Application

Access the application overview through the management node's IP address and verify that the application can be opened successfully.