Push: Openfire with Conversations (Jabber / XMPP) p2 Proxy

MaxIn · April 26, 2026, 2:04pm

Hi.

I tried setting up OpenFire and Conversations with Push plugin.

The client uses a proxy to enable Google Push due to technology limitations.

I configured everything on the server (Push plugin, Push Server).

I configured s2s communication (port, nat, white list) with p2.siacs.eu, but they can’t connect.

At the final stage they fall off. What am I doing wrong?

Sending server to server ping request to p2.siacs.eu
Routing to remote domain:

A new outgoing session for {hidden.site → p2.siacs.eu} is needed. Instantiating a new queue stanza for delivery when that’s done.
Created new PacketProcessor for {hidden.site → p2.siacs.eu}
Queuing stanza to intended recipient ‘p2.siacs.eu’ in the outgoing session promise to domain ‘{hidden.site → p2.siacs.eu}’: 
Start for {hidden.site → p2.siacs.eu}
Start establishing a connection for {hidden.site → p2.siacs.eu}
Start domain authentication …
Searching for pre-existing outgoing sessions to the remote domain (if one exists, it will be re-used) …
There are no pre-existing outgoing sessions to the remote domain itself. Searching for pre-existing outgoing sessions to super- or subdomains of the remote domain (if one exists, it might be re-usable) …
There are no pre-existing session to other domains hosted on the remote domain.
Unable to re-use an existing session. Creating a new session …
Creating new session…
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@31374549
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@4c4bdd23
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@20c33b8a
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@63c777ea
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@68516bd6
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@7a61113a
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@43c76a97
instrumented a special java.util.Set into: sun.nio.ch.WEPollSelectorImpl@1be72d22
Creating plain socket connection to a host that belongs to the remote XMPP domain.
Creating a socket connection to XMPP domain ‘p2.siacs.eu’ …
Use DNS to resolve remote hosts for the provided XMPP domain ‘p2.siacs.eu’ (default port: 5269) …
DNS SRV Lookup for service ‘xmpp-server’, protocol ‘tcp’ and name ‘p2.siacs.eu’
1 SRV record(s) found for ‘_xmpp-server._tcp.p2.siacs.eu.’:

SrvRecord{hostname=‘ganymede.siacs.eu’, port=5269, isDirectTLS=false, priority=1, weight=1}
DNS SRV Lookup for service ‘xmpps-server’, protocol ‘tcp’ and name ‘p2.siacs.eu’
No SRV record found for ‘_xmpps-server._tcp.p2.siacs.eu.’
Answering lookup for domain ‘p2.siacs.eu’ from DNS responses. Returning:

SrvRecord{hostname=‘ganymede.siacs.eu’, port=5269, isDirectTLS=false, priority=1, weight=1} (based on a DNS lookup)

SrvRecord{hostname=‘p2.siacs.eu’, port=5269, isDirectTLS=false, priority=2147483647, weight=0} (a fallback, based on the XMPP domain and default port)
Instantiating new instance for 1 service records, preferring IPv6 (rather than IPv4), using a resolution delay of PT0.05S
Start resolution of (1) host addresses

Index 0 : SrvRecord{hostname=‘ganymede.siacs.eu’, port=5269, isDirectTLS=false, priority=1, weight=1}
Attempting to get next (preferred) address immediately (preferred next index: 0, preferred next family: IPv6
No preferred result available.
Resolution delay not over. Waiting up to 49ms for a preferred address to become available
Start resolving address at index 0 …
Resolved address at index 0 into:

IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false}
Attempting to get next (preferred) address immediately (preferred next index: 0, preferred next family: IPv6
No preferred result available.
Resolution delay not over. Waiting up to 46ms for a preferred address to become available
Attempting to get next (preferred) address immediately (preferred next index: 0, preferred next family: IPv6
No preferred result available.
Attempting to get next (alternative) address immediately (preferred next index: 0, preferred next family: IPv6
Found alternative by preferred next index (0): IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false}
Found alternative: IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false}
Next resolved address for ‘p2.siacs.eu’: IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false}
Scheduling connection attempt for ‘p2.siacs.eu’ to IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false} after a delay of PT0S
Wait for all connection attempts to have finished, before moving to the next priority set.
Trying to create socket connection to XMPP domain ‘p2.siacs.eu’ using resolved address: IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false}…
Successfully created socket connection to XMPP domain ‘p2.siacs.eu’ using resolved address: IndexedResolvedServiceAddress{index=0, inetAddress=ganymede.siacs.eu/78.47.177.120, port=5269, isDirectTLS=false}!
Done iterating over a priority set for ‘p2.siacs.eu’
Finished resolving XMPP domain ‘p2.siacs.eu’
Shutting down
Aborting resolution of ‘p2.siacs.eu’, as the executor is being shut down (likely cause: we successfully identified a result).
Successfully created a socket connection to XMPP domain ‘p2.siacs.eu’, using: ganymede.siacs.eu/78.47.177.120:5269 (not directTLS)
Opening a new connection to ganymede.siacs.eu/78.47.177.120:5269 that is initially not encrypted.
Adding NettyOutboundConnectionHandler
Netty XMPP handler added: null
Send the stream header and wait for response…
Sending: <stream:stream xmlns:stream=“http://etherx.jabber.org/streams” xmlns=“jabber:server” xmlns:db=“jabber:server:dialback” from=“hidden.site” to=“p2.siacs.eu” version=“1.0”>
Handler on /192.168.13.5:51708–ganymede.siacs.eu/78.47.177.120:5269 received: 
Handler on /192.168.13.5:51708–ganymede.siacs.eu/78.47.177.120:5269 received: <stream:stream id=‘17206378397678612096’ version=‘1.0’ xml:lang=‘en’ xmlns:db=‘jabber:server:dialback’ xmlns:stream=‘http://etherx.jabber.org/streams’ to=‘hidden.site’ from=‘p2.siacs.eu’ xmlns=‘jabber:server’>
Handler on /192.168.13.5:51708–ganymede.siacs.eu/78.47.177.120:5269 received: stream:features</stream:features>
Connection ‘[78, 47, -79, 120]’ defined namespace prefixes on its original ‘stream’ element: xmlns:db=“jabber:server:dialback”, xmlns:stream=“http://etherx.jabber.org/streams”
Both us and the remote server support the STARTTLS feature. Encrypt and authenticate the connection with TLS & SASL…
Indicating we want TLS and wait for response.
Sending: 
Handler on /192.168.13.5:51708–ganymede.siacs.eu/78.47.177.120:5269 received: 
Connection ‘[78, 47, -79, 120]’ defined namespace prefixes on its original ‘stream’ element: xmlns:db=“jabber:server:dialback”, xmlns:stream=“http://etherx.jabber.org/streams”
Received ‘proceed’ from remote server. Negotiating TLS…
Encrypting and authenticating connection …
Configured TrustManager class: org.jivesoftware.openfire.keystore.OpenfireX509TrustManager
Attempting to instantiate ‘class org.jivesoftware.openfire.keystore.OpenfireX509TrustManager’ using the four-argument constructor that is proprietary to Openfire.
Constructed trust manager. Number of trusted issuers: 143, accepts self-signed: false, checks validity: true, checks revocation: false
Successfully instantiated ‘class org.jivesoftware.openfire.keystore.OpenfireX509TrustManager’.
Attempting to verify a chain of 2 certificates.
Validating chain with 2 certificates, using 142 trust anchors.
[id: 0xb04c785f, L:/192.168.13.5:51708 - R:ganymede.siacs.eu/78.47.177.120:5269] HANDSHAKEN: protocol:TLSv1.3 cipher suite:TLS_AES_256_GCM_SHA384
CertificateManager: Subject Alternative Name Mapping returned [p2.siacs.eu, up.conversations.im]
TLS negotiation with ‘p2.siacs.eu’ was successful. Connection encrypted. Proceeding with authentication.
Sending: <stream:stream xmlns:stream=“http://etherx.jabber.org/streams” xmlns=“jabber:server” xmlns:db=“jabber:server:dialback” from=“hidden.site” to=“p2.siacs.eu” version=“1.0”>
Running HTTP Session Reaper
An exception occurred while creating a session. Closing connection.
java.util.concurrent.TimeoutException: null
at java.util.concurrent.CompletableFuture.timedGet(CompletableFuture.java:1960) ~[?:?]
at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2095) ~[?:?]
at org.jivesoftware.openfire.session.LocalOutgoingServerSession.createOutgoingSession(LocalOutgoingServerSession.java:264) ~[xmppserver-5.0.4.jar:5.0.4]
at org.jivesoftware.openfire.session.LocalOutgoingServerSession.authenticateDomain(LocalOutgoingServerSession.java:211) ~[xmppserver-5.0.4.jar:5.0.4]
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.establishConnection(OutgoingSessionPromise.java:287) ~[xmppserver-5.0.4.jar:5.0.4]
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.run(OutgoingSessionPromise.java:243) ~[xmppserver-5.0.4.jar:5.0.4]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) ~[?:?]
at java.lang.Thread.run(Thread.java:1583) [?:?]
Closing NettyConnection{peer: ganymede.siacs.eu/78.47.177.120:5269, state: CLOSED, session: null, Netty channel handler context name: NettyOutboundConnectionHandler#0} with optional error: null
Flushed any final bytes, closing connection.
Notifying close listeners.
Notifying close listeners of connection NettyConnection{peer: ganymede.siacs.eu/78.47.177.120:5269, state: CLOSED, session: null, Netty channel handler context name: NettyOutboundConnectionHandler#0}
Finished closing connection.
Netty XMPP handler removed: /192.168.13.5:51708–ganymede.siacs.eu/78.47.177.120:5269
Unable to authenticate: Fail to create new session.
An exception occurred while trying to establish a connection for {hidden.site → p2.siacs.eu}
java.lang.Exception: Failed to create connection to remote server: {hidden.site → p2.siacs.eu}
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.establishConnection(OutgoingSessionPromise.java:302) ~[xmppserver-5.0.4.jar:5.0.4]
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.run(OutgoingSessionPromise.java:243) ~[xmppserver-5.0.4.jar:5.0.4]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) ~[?:?]
at java.lang.Thread.run(Thread.java:1583) [?:?]
Purging queue for {hidden.site → p2.siacs.eu}
Bouncing queued stanza:


Finished processing {hidden.site → p2.siacs.eu}
Erroneous server to server response received.
Failed to establish server to server session.

guus · May 9, 2026, 9:06am

Hi! Sorry to hear that you’re running into issues. I think this is a network configuration issue.

For XMPP S2S, the remote server (p2.siacs.eu) must be able to connect back to your server on the public internet over port 5269.

Openfire may successfully initiate outbound TLS (which I think I see being successful in the logs that you provide), but the remote side will try to connect back to your server over a different connection. This may be failing.

My advise is that you check if you are:

correctly advertising the IP address (through DNS) on which your domain/server is reachable. Make sure that you have DNS records accessible to the peer, and that these advertise the correct, public address (instead of an internal/private address)
either ensure that IPv6 is working, or is not advertised
check if TLS certifcates are correct (not expired) and are valid for the domain name of your Openfire instance

MaxIn · May 9, 2026, 2:12pm

Everything is set up perfectly, with one exception. I don’t have an IPv6 address. IPv4 only! Is that a problem?

guus · May 12, 2026, 10:46am

No, it shouldn’t be. As far as I remember, connectivity with that push server works the same as setting up server-to-server communication (federation) between your server and any other XMPP domain. Perhaps you can use that to test your setup. Do you have another XMPP server available (or can you set one up, even temporarily), outside of your network? You could use that to experiment with the connection configuration.