Solved 3CX behind PFSense with HAProxy IP Blacklist Issues

[thegrs]

Over the past week or so it appears that my 3CX system has become a target for someone. I am currently on 3CX Version 20.0 Update 9 (Build 995 Release - AI 1.4.48). The 3CX anti-hacking rules are kicking in and attempting to block them. In the 3CX logs it is saying the source is the Webclient / API.

The issue I am having is my 3CX system is behind a PFSense Firewall with the HAProxy add in due to us hosting a couple of websites / resources on the same public IP address. 3CX is seeing the attackers IP address as the PFSense IP Address instead of the actual external IP Address. This is causing all traffic to the web interface to be blocked. If I remote into the 3CX Host system I can remove the PFSense blacklist IP and the web interface becomes available again. I haven't done a firewall test recently but the last time I did it passed and none of the PFSensor or HAProxy settings have been changed since then.

From some of the web development I have done for our company I believe this is due to how HAProxy handles the connection. The HAProxy Front End rule for 3CX has the Use "ForwardFor" Option checked, is there anyway to configure 3CX to look for this value instead of the PFSense IP Address? Is there any other way to configure this to get it to work correct?

 

[SweetAction]

Officially speaking, 3CX does not support proxied connections. They do support using other ports, like 5000/5001 instead of 80/443.

That being said, 3CX uses nginx and if you were going to be unsupported, you could always edit the config to respect x-forward-for at your own risk.

 

[BrunoI_3CX]

Could you please confirm whether the system is deployed behind a reverse proxy, with the mentioned HAProxy forwarding all HTTP/HTTPS traffic to the system?

Additionally, could you confirm whether this behavior started after upgrading to Update 9, or was it also present in previous versions?

Regarding your question, there is currently no supported way to configure the system to use the X-Forwarded-For header for the anti-hacking or IP blacklist mechanisms.

As a first step, we recommend confirming that the Firewall Checker under Admin > Dashboard > Troubleshooting completes successfully.

 

[thegrs]

Thank you both for your reply. I did a little more digging and realized that the pbx's public IP address is not used for any of our other websites or services. I removed the pbx from the HAProxy system and have PFsense configured based on the guide that 3CX published.

The system appears to be working but I don't yet have any hacking attempts to confirm that 3CX is now seeing the actual IP Address coming in instead of the PFSensor box.

@BrunoI_3CX below are answer your questions.

This morning when i first posted about this issue it was configured that HAProxy was forwarding all Http/Https traffic to the pbx. After @SweetAction and your reply, I reviewed our public IP addresses I discovered that 3CX was the only thing hosted on this IP so I removed the Http/Https traffic from behind HAProxy. PFSense is now configured as show in the public 3CX documentation.

I believe that this behavior has been like this the entire time, not just in update 9. I just think we were not being targeted before so it went under the radar. The reason I say this is we had a spam chat come in from our website thru the 3CX's chat and one of my users selected Block anonymous user and it blacklisted the PFSense IP Address.

Lastly, the 3CX firewall check passed both before I made the changes today and after. It doesn't appear that the 3CX firewall checker is configured to flag the configuration we had.

 

[thegrs]

I just performed a test using my cell phone connected to the cell network. 3CX is seeing the cell phone's IP address instead of the PFSense one during a chat session so I believe this is resolved now.