Simple configuration FIXEdge -> Stunnel -> (VPN) -> SSL acceptor

Install stunnel

...

Stunnel installation

Download latest version of the installer from from https://www.stunnel.org/downloads.html

Run the installer and answer questions to generate a certificate.

Configuration example #1. FIXEdge's initiator connects to SSL acceptor over Stunnel

Configure stunnel

Initiator FIX session

1. Run stunnel GUI Start from Start menuRun menu Run  

2. Editstunnel.conf from stunnel system tray icon context menu

3. Add option 
   protocol = proxy
4. Comment example SSL services
Add SSL service

. Add a new SSL service

Code Block
title stunnel.conf
[fix_initiator_session1_tunnel]




client = yes




accept  = 127.0.0.1:443




connect

= 63.247.113.201:443Run

= <counterparty_ip>:443

<counterparty_ip> - ip address of counterparty

5. Reload stunnel.conf from stunnel system tray icon context menu

Configure fix session in FIXEdge

1. Open FIXEdge.properties to specify Initiator FIX session parameters:

   Initiator FIX session

   Code Block
   title FIXEdge.properties
   FixLayer.FixEngine.Session.SSLInitiator.Role = Initiator FixLayer.FixEngine.Session.SSLInitiator.Host = 127.0.0.1 FixLayer.FixEngine.Session.SSLInitiator.Port = 443

   Info
   See Additional properties for SSL configuration also

2. Connect to VPN (if necessary; if not, just skip this step);

3. Start FIXEdge.

Complex configuration: Broker/Stock -> Broker's/Stock's Stunnel -> FIXEdge's Stunnel -> FIXEdge -> FIXEdge's Stunnel -> Broker's/Stock's Stunnel -> Broker/Stock

Server F (FIXEDGE):  y.y.y.y where FIXEdge is installed

Server B (BROKER):  x.x.x.x where SimpleClient #1 and SimpleClient #2 are installed. SimpleClient #1 will simulate Broker and SimpleClient #2 will simulate StockExchange.

Server F (FIXEDGE) Configuration

FIXEdge.properties

...

Configuration example #2. FIXEdge is a proxy between 2 counterparties.

The current configuration describes the following scenario.

FIXEdge establishes SSL connection to Exchange. The client connects to FIXEdge over SSL. All messages from Exchange are routed to the Client and vice versa.

Stunnel is configured for Incoming and outgoing connections on FIXEdge's side and on the Client side.

Image Added

Configuration on FIXEdge side

FIXEdge.properties

FIXEdge has two configured sessions: EXCHANGE and CLIENT

FixLayer.FixEngine.Sessions = EXCHANGE, CLIENT
# -----------------[ SC1FIXEdge ASconnects ACCEPTORto SENDEXCHANGE MESSAGEas TO SC2Initiator ] ------------------
FixLayer.FixEngine.Session.FIXEDGE-SC1EXCHANGE.VersionRole = FIX44Initiator
FixLayer.FixEngine.Session.FIXEDGE-SC1EXCHANGE.EncryptMethodHBI = 030
FixLayer.FixEngine.Session.FIXEDGE-SC1EXCHANGE.ForceSeqNumResetHost = 127.0
FixLayer.FixEngine.Session.FIXEDGE-SC1.IgnoreSeqNumTooLowAtLogon = false
FixLayer.FixEngine.Session.FIXEDGE-SC1.IntradayLogoutTolerance = false
FixLayer.FixEngine.Session.FIXEDGE-SC1.MaxMessagesAmountInBunch = 0
FixLayer.FixEngine.Session.FIXEDGE-SC1.RecreateOnLogout = false.1
FixLayer.FixEngine.Session.FIXEDGE-SC1EXCHANGE.TerminateOnLogoutPort = true444
FixLayer.FixEngine.Session.FIXEDGE-SC1EXCHANGE.RejectMessageWhileNoConnectionVersion = falseFIX44
FixLayer.FixEngine.Session.FIXEDGE-SC1.Role = Acceptor
FixLayer.FixEngine.Session.FIXEDGE-SC1.EXCHANGE.SenderCompID = FIXEDGE
FixLayer.FixEngine.Session.FIXEDGE-SC1EXCHANGE.SenderLocationIDTargetCompID = FixLayer.FixEngine.Session.FIXEDGE-SC1.SenderSubID =
FixLayer.FixEngine.Session.FIXEDGE-SC1.SocketPriority = EVEN
FixLayer.FixEngine.Session.FIXEDGE-SC1.SecurityGroups =
FixLayer.FixEngine.Session.FIXEDGE-SC1.StorageType = persistentmm
FixLayer.FixEngine.Session.FIXEDGE-SC1.TargetCompID = SC1
FixLayer.FixEngine.Session.FIXEDGE-SC1.TargetLocationID =
FixLayer.FixEngine.Session.FIXEDGE-SC1.TargetSubID =
FixLayer.FixEngine.Session.FIXEDGE-SC1.TcpBufferDisabled = false

EXCHANGE
# ... the rest parameters for EXCHANGE

# ----------------- [SC2 AS FIXEdge INITIATORaccepts RECEIVEDconnection MESSAGESfrom SENTthe FROM  SC1CLIENT] ----------
FixLayer.FixEngine.Session.FIXEDGE-SC2CLIENT.VersionRole = FIX44Acceptor
FixLayer.FixEngine.Session.FIXEDGE-SC2CLIENT.EncryptMethodVersion = 0FIX44
FixLayer.FixEngine.Session.FIXEDGE-SC2.ForceReconnect = false
FixLayer.FixEngine.Session.FIXEDGE-SC2.ForceSeqNumReset = 0
FixLayer.FixEngine.Session.FIXEDGE-SC2.HBI = 30
FixLayer.FixEngine.Session.FIXEDGE-SC2.Host = 127.0.0.1
FixLayer.FixEngine.Session.FIXEDGE-SC2.IgnoreSeqNumTooLowAtLogon = false
FixLayer.FixEngine.Session.FIXEDGE-SC2.IntradayLogoutTolerance = false
FixLayer.FixEngine.Session.FIXEDGE-SC2.MaxMessagesAmountInBunch = 0
FixLayer.FixEngine.Session.FIXEDGE-SC2.Port = 444
FixLayer.FixEngine.Session.FIXEDGE-SC2.RecreateOnLogout = false
FixLayer.FixEngine.Session.FIXEDGE-SC2.TerminateOnLogout = true
FixLayer.FixEngine.Session.FIXEDGE-SC2.RejectMessageWhileNoConnection = false
FixLayer.FixEngine.Session.FIXEDGE-SC2.Role = Initiator
FixLayer.FixEngine.Session.FIXEDGE-SC2.CLIENT.SenderCompID = FIXEDGE
FixLayer.FixEngine.Session.FIXEDGE-SC2CLIENT.SenderLocationIDTargetCompID = FixLayer.FixEngine.Session.FIXEDGE-SC2.SenderSubID =
FixLayer.FixEngine.Session.FIXEDGE-SC2.SocketPriority = EVEN
FixLayer.FixEngine.Session.FIXEDGE-SC2.SecurityGroups =
FixLayer.FixEngine.Session.FIXEDGE-SC2.StorageType = persistentmm
FixLayer.FixEngine.Session.FIXEDGE-SC2.TargetCompID = SC2
FixLayer.FixEngine.Session.FIXEDGE-SC2.TargetLocationID =
FixLayer.FixEngine.Session.FIXEDGE-SC2.TargetSubID =
FixLayer.FixEngine.Session.FIXEDGE-SC2.TcpBufferDisabled = falseCLIENT
# ... the rest parameters for CLIENT

BL_Config.xml

Simple routing configuration

<Rule>
	<Source Name="FIXEDGE-SC1CLIENT"/>
    <Action>
    	<Send Name="FIXEDGE-SC2EXCHANGE" />
	</Action>
</Rule>

<Rule>
	<Source Name="FIXEDGE-SC2EXCHANGE"/>
    <Action>
    	<Send Name="FIXEDGE-SC1CLIENT" />
    </Action>
</Rule>

stunnel.conf

[ToStockExchangeTunnel_for_EXCHANGE]
protocol = proxy
client = yes
accept  = 127.0.0.1:444
connect = x.x.x.x<exchange_ip>:443
 
[FromBrokerTunnel_for_CLIENT]
protocol = proxy
accept  = y.y.y.y<FIXEdge_ip>:443
connect = 127.0.0.1:8901

...

Configuration on the Client side

stunnel.conf

[FromBrokerToFIXEdgeTunnel_for_FIXEdge]
protocol = proxy
client = yes
accept  = 127.0.0.1:444
connect = <FIXEdge_ip>:443

Client's properties

SenderCompID = Client
= y.y.y.y:443

[FromFIXEdgeToStockExchange]
protocol = proxy
accept  = x.x.x.x:443
connectTargetCompID = FIXEDGE
Remote host = 127.0.0.1
Remote port = 444

FIXEdge uses Windows certificate store for connection to an Exchange.

1. Import the certificate to windows certificate with a certutil tool

   Code Block
   certutil -addstore -user -f "My" <filename>.crt

2. Configure Windows Certificate store in Stunnel

   Code Block
   title stunnel.conf
   engine = capi

   and configure tunnel for the session requiring SSL Connection

   Code Block
   title stunnel.conf
   [Exchange SSL connection] client = yes engineId = capi accept = 127.0.0.1

...

SimpleClient #1 conf

...

1. :8443 connect = <exchange ip>:<exchange port>

   <exchange ip> - Enchange connection IP
   <exchange port> - Enchange connection port

2. Configure Initiator session in FIXEdge.properties

   Code Block
   title FIXEdge.properties
   FixLayer.FixEngine.Session.EXCHANGE.Version = FIX44 FixLayer.FixEngine.Session.EXCHANGE.Role = Initiator FixLayer.FixEngine.Session.EXCHANGE.SenderCompID =

...

1. FIXEDGE FixLayer.FixEngine.Session.EXCHANGE.TargetCompID =

...

1. EXCHANGE FixLayer.FixEngine.Session.EXCHANGE.Host = 127.0.0.1

...

Set ListenPort in engine.properties to 9107 (ListenPort = 9107)

SimpleClient #2 conf

Set ListenPort in engine.properties to 9106 (ListenPort = 9106)

How to use

1. Start SimpleClient #2
2. Start FIXEdge - session between FIXEdge and SimpleClient #2 (SC2) should be established
3. Start SimpleClient #1 (SC1) and establish session with FIXEdge using parameters from point 3
4. Send application level messages from SimpleClient #1 - message will be routed to SimpleClient #2
5. Send application level messages from SimpleClient #2 - message will be routed to SimpleClient #1

...

1. FixLayer.FixEngine.Session.EXCHANGE.Port = 8443 FixLayer.FixEngine.Session.EXCHANGE.HBI = 30 FixLayer.FixEngine.Session.EXCHANGE.RecreateOnLogout = true

   Info
   See Additional properties for SSL configuration also