Cold room temperature node on an ESP8266 (Wemos D1 mini), PubSubClient over BearSSL to Hermetry on 8883. At home it worked on DHCP. At the plant, on DHCP it joins Wi-Fi, gets an address, and then never connects to the broker:
WiFi connected, IP 10.20.31.144
Attempting MQTT connection...failed, rc=-2
Attempting MQTT connection...failed, rc=-2Our maintenance tech «fixed» it by hardcoding a static IP, gateway, subnet and 8.8.8.8 as DNS in WiFi.config(). Then it connects straight away. Now IT found the static address and wants it gone, everything on that network has to be DHCP. What is DHCP doing differently that breaks the connection?
Maybe the DHCP lease is slow and the code tries MQTT before the address is ready?
Could you just connect to the broker’s IP address instead? Then DNS doesn’t matter.
Kevin, no: the broker needs SNI, so you have to connect by host name, and the certificate check is against that name too. IP is a dead end.
The clue is that the tech’s static config included 8.8.8.8. rc=-2 in PubSubClient is «connect failed», which on an 8266 is very often a failed name lookup. I’ve seen this on plant networks a few times: the DHCP server hands out the plant’s internal DNS server, and that one only answers for internal names, or blocks outside lookups. With static config the board used 8.8.8.8 instead and everything worked. Add this after connecting and you’ll see it:
Serial.println(WiFi.dnsIP());
IPAddress ip;
Serial.println(WiFi.hostByName(MQTT_HOST, ip) ? ip.toString() : "lookup failed");Then ask IT for one of two things: let their DNS resolve your organisation’s broker host name (it’s on the device’s Connection details card), or allow outbound DNS from that VLAN. And while you’re talking to them, outbound TCP 8883 has to be open as well, plus 443 if you ever use HTTPS. Wilson’s guess is worth guarding against anyway: wait for WiFi.localIP() to be non-zero before the first connect.
You nailed it. dnsIP was an internal server and the lookup failed. IT added a forwarder for the broker host, the node is back on DHCP and connected first try. They were happier to do that than to see a static IP.
- Debes estar registrado para responder a este debate.
Únete a la conversación
Inicia sesión para preguntar y responder, dar me gusta a las publicaciones útiles y marcar la respuesta que resolvió tu problema. Cada aportación suma puntos y niveles.