Solved 3CX-App has problems with Tunnel mode 15.5.280

[Severin Meyer]

When outside of the office, the Android app is almost never ringing.
This happens since many month now.

After playing around with the settings, I could achieve a more stable behavior by disabling the tunnel option.
I could reproduce the following once:
WLAN disabled, Tunnel on:
- Call the phones extension -> Phone is ringing
- Disable mobile data on the phone
- Call the phones extension -> Phone is not ringing (of course)
- Reenable mobile data on the phone and wait some seconds
- Call the phones extension -> Phone is not ringing (terrible)

The same procedure with tunnel option off has no problems.

After checking this out, I was trying to reproduce it again with the tunnel option on.
But unfortunately, as soon as I turn the tunnel option on, the phone cannot establish a call at all (nor in nor out).
So I will disable the tunnel option by now. But it seems there is a massiv problem with it.

On the server side I'm on 15.5.9348.3 Linux Debian 9.
Firewall Check runs without a problem.

 

[Marios Neophytou]

Hello @Severin Meyer,

I have sent you a P.M

Thank you

 

[RocketPoweredLlama]

I think I might have the same problem. Looking at my firewall logs the 3CX android client appears to be dead set on always attempting to register over SIP/TLS (TCP 5061) any time you launch it.

Since I don't have SIP ports open to the Internet and only have the tunnel open that means that remote Android extensions don't work.

 

[Marios Neophytou]

Hello @RocketPoweredLlama,

If port 5060 is blocked and it is configured to be the PBX's default SIP port then you will never receive any call on any of your extension and not only on android.

Also, can you send me a log file via P.M in Verbose mode (Settings > Advanced Setting> Verbose Logging) that shows this behavior?

Thank you

 

[Severin Meyer]

It turned out, that at least the tunnel is not supporting SRTP at all.
So I will disable the tunnel completely.
As also the additional roundtrip voice delay while running on tunnel is 20ms at 50ms higher than connecting directly, I will get another improvement.

 

[Marios Neophytou]

@Severin Meyer,

Thank you for your feedback and co-operation , problem solved through P.Ms

 

[Severin Meyer]

I still think the tunnel is not working as it should.
After disabling the tunnel, I observe more stable connections, especially when on mobile data.
So tagging a thread as solved, when the answer is "don't use the tunnel" is a bit weird.

 

[RocketPoweredLlama]

I have sent through a PM with the information requested.

With no configuration changes on my end, this worked a month or two ago. One of the 3CX client or server updates broke the functionality.

Previously the Android client would connect to my edge firewall from the Internet and connect on port 5090, establish a tunnel, register to the PBX and everything worked just fine.
Once one of those two updates happened, the Android client makes zero attempts to connect to port 5090 and establish a tunnel session, so it cannot register.

In other words, it refuses to attempt to use the tunnel when registering from the Internet. It tries to register via port 5061 using SIP-TLS and if that fails it doesn't make any connection attempt to 5090 to use the tunnel.

So it worked at least in December of 2017, possibly January of 2018, but now it is broken.

 

[RocketPoweredLlama]

Seeing your messages and responses, I change the provisioning settings for the 3CX client and told it to use TCP for SIP and Normal for RTP instead of TLS and Allow Secure and it connects to the PBX just fine now after resending the provisioning file.

So something broke TLS and SRTP support for the tunnel on the Android client, because it used to work.