3CX and Zabbix Agent

[ACS2018]

Hello All,
I run a Zabbix server within one of my local to me LANs and I run my 3CX server in the cloud. I was hoping to gain more insight into my 3CX server by connecting it up to my Zabbix server. Unfortunately I can't get the 3CX zabbix-agent to successfully connect. After adding the host in the Zabbix web GUI the availability indicator turns red with the following error message: "Get value from agent failed: cannot connect to [[199.195.252.150]:10050]: [4] Interrupted system call".

I have a feeling there is something on the 3CX system (iptables?) that's blocking me. I was hoping someone here has solved the problem I am up against before and can give me some tips as I have been working on it on and off for days.


NOTE: IPs have been slightly obfuscated


Zabbix Server
Firewall: Behind pfsense firewall. Port 10051 has been opened for the 3CX servers external IP
UFW: Port 10051 from the WAN IP of my 3CX server has been opened.
Local IP: 11.0.105.1
WAN IP: 73.154.152.100
Server Web UI Host Config:
- Hostname: acsv (same as hostname on 3CX server)
- Groups: Linux Servers
- Interfaces: 199.195.252.150 IP 10050
- Template: Linux by Zabbix agent
- Encryption: None (I plan on using PSK once I can get the connection to initiate)
- Enabled: Checked
Output of sudo ufw status numbered: attached
Output of


3CX Server
Firewall: N/A
UFW: Port 10050 from the WAN IP of my Zabbix server has been opened.
Local IP: N/A
WAN IP: 199.195.252.150
zabbix-agent Config:
- Server=11.0.105.1,73.154.152.100
- ServerActive=73.154.152.100
- Hostname=acsv
Output of sudo ufw status numbered: attached
Output of sudo iptables -L -n: attached


Other points to note:
- The Zabbix server has no other hosts reporting issues. I have one other cloud VM hosted on the same platform (BuyVM) and it's not reporting errors.
- tried installing the zabbix-agent from the built in 3CX customized source list AND through a direct .deb package. (installed fine but no change in connection) (tried this as one of last steps)
+ package URL: https://repo.zabbix.com/zabbix/5.0/...x-release/zabbix-release_5.0-1+buster_all.deb
- I usually use UFW instead of iptables since it's easier for me to understand. Could this be causing conflicts?

 

[Michael Jennings]

So we manage hundreds of hosted 3cx in our Cloudflare Protected hosting environment. Below are generic notes for enabling Zabbix within nftable. If you need additional support call (402) 779-7707 and ask for Mike or Nathan.

# nftables-notes
How to use nftables in Debian 10
## nftables
To list rules:
nft list ruleset
nft list table filter
To flush nftables:
nft flush ruleset
To reload nftables that are in /etc/nftables.conf:
systemctl restart nftables
To check the nftables for errors:
nft -c -f /etc/nftables.conf

To apply nft file to current ruleset:
nft -f nft_ruleset.nft
Over-write current ruleset to /etc/nftables.conf:
nft list ruleset > /etc/nftables.conf

<!-- blank line -->
----
<!-- blank line -->
## iptables to nftables translation
Translate current iptables to thier nft equivalent:
iptables-restore-translate -f /etc/iptables/rules.v4 > nft_ruleset.nft
Remove old iptables:
rm /etc/iptables/rules*

**Best practice, definitely necessary**:
systemctl enable nftables
If installing on a system with Dockers
systemctl restart docker.service
or restart system
### TLDR; to migrate iptables to nftables
- [ ] `iptables-restore-translate -f /etc/iptables/rules.v4 > nft_ruleset.nft`
- [ ] `nft -f nft_ruleset.nft`
- [ ] `nft list ruleset > /etc/nftables.conf`

For further details see:
[https://wiki.nftables.org/wiki-nfta...s/index.php/Moving_from_iptables_to_nftables)

[https://www.gaelanlloyd.com/blog/mi...ing-debian-buster-from-iptables-to-nftables/)

[https://www.vultr.com/docs/nftables...ww.vultr.com/docs/nftables-quickstart-guide/)
[https://wiki.nftables.org/wiki-nfta...i-nftables/index.php/Matching_packet_headers)
[https://wiki.debian.org/nftables](https://wiki.debian.org/nftables)
netfilter-persistent is installed with 3CX packages
iptables-restore < /etc/iptables/rules.v4

 

[ACS2018]

Thank you so much Mike.

I ended up manually editing the /etc/nftables.conf file to include the SSH and Zabbix lines in the script file you attached adding my office IP of course. After rebooting it seems to have done the trick. The 3CX system is now connected to my Zabbix server without errors.

If you wouldn't mind me asking can you see anything off about my software firewall setup? It seems like the UFW rules I added are still active which works for me. I am just not comfortable enough to make the complete jump to nftables.

 

[Michael Jennings]

We have been using the NFT in the wild. What's more, 3CX applies its own NFT rules every time the services restart...
Run the 'nft list ruleset >> /tmp/exporturleset.txt' sanitize and send it. Nathan or I can take a look.

 

[Michael Jennings]

Replaced the UFW with NFT... to many 3 letters