[dsummer]

Hi all. I'm still not getting proper behavior from 3CXPhone sometimes. Some inbound calls keep ringing forever without timeout, while others will complete but have a terrible delay. I still think it's related to my firewall settings so I hope this thread will serve as the definitive list of what ports must be open for 3CXPhone to always work. The environment is: 3CXPhone 5.0.14900.0 in Windows 7 connecting only to SIP providers (no PBX). Under 'General Settings', the RTP port range is 16384-16482 and Local port is 5070 with the Any box unchecked.

Right now, my DD-WRT router is forwarding the following inbound ports for VoIP to my desktop computer (192.168.1.13):

UDP 5060-5080 to .13
UDP 16384-16482 to .13
UDP 3478 to .13 (STUN?)

Are there any other ports I should add or remove? Please assume, as with most consumer routers, that there are no restrictions on outbound ports (source or destination).

Thanks for your input and to 3CX for this free softphone (that I wish worked perfectly for me).

[leejor]

I have personally never had to do any port forwarding to get 3CX phone (or a single ATA) working behind a router. That said, there are several things that can cause issues. These include... other SIP devices (or any device using the same ports) on your network, or, if you are using a router with a built-in ATA, or, if you happen to have one of the few routers that either doesn't play nice with SIP or needs some tweaking to make it do so. There are probably a few others that I haven't encountered (yet).

I've used both ATA's and WiFi SIP phones extensively when travelling, (both with 3CX and VoIP providers), at hotspots in hotels, Cafes and friends homes.

Of course, I don't have access to any port forwarding options on their routers, and, in the majority of cases, calls go through with no problems.

[willow]

if your router is a normal consumer router then most of the time you just need to enable stun on the softphone and not even have to worry about port forwarding anything just like leejor said. I only have to port forward on commercial grade routers like sonicwall and other that can be real pain. most consumer routers just pass info back and forth and dont really care about security. just as long as the registration stays alive between your sip phone and the sip providor you should not have any issues.

[eagle2]

Hi,

this sounds like firewall / NAT problem into your router. If this is a typical standard installation you should not forward any ports to internal addresses for SIP endpoints, including 3CX softphone. Normally a SIP phone will establish necessary address:port translation into the router while registration and this should be enough, without any need to use fixed ports in 3CX softphone or other SIP device (this is not the case with 3CX PhoneSystem or other SIP server). Port forwarding like described in your post is helping for NAP/NAPT of incoming traffic (WAN to LAN) and not for outgoing (LAN to WAN). In some more advanced routers this is set independently or you need symmetric NAT/NAPT plus issues related to STUN, SIP ALG, etc.

Try to investigate with wireshark why this is happening, the reason could be the address:port mapping is becoming invalid (expires after some time) -- try to discover a period after which the 3CX softphone stops working. My idea is either to use some keepalives, or reduce the period between registrations (if 3600 seconds make it 300 or similar). This could solve the issue.