Solved 3CX Cloud based - Clients behind Sophos UTM-9 Firewall

[benitok]

Hi,

We've got a 3CX Server hosted in the cloud. On our internal network we have a 3CX SBC setup on a Raspberry Pi and we are using 3cx client on Windows laptops.

Everything works perfectly, but now we are in the process of installing a Sophos UTM-9 Firewall and we need some assistance on how to configure the firewall rules. Initial attempts have failed, so it is back to the drawing board.

I noticed the post https://www.3cx.com/community/threads/3cx-behind-sophos-utm-9-firewall.40813/ by @MillsAz which is very good, but he has an internal 3CX server where we have an external 3CX server.

Has anyone setup a Sophos UTM-9 Firewall with a 3CX Server hosted in the cloud?

Thank you,
Benito

 

[jasonross]

You should only need to permit the SBC tunnel port and an https connection to your PBX so provisioning can work.

No special NAT required if you are using the SBC, pretty easy install when all is said and done.

Jason

 

[benitok]

You should only need to permit the SBC tunnel port and an https connection to your PBX so provisioning can work.

No special NAT required if you are using the SBC, pretty easy install when all is said and done.

Jason

Hi Jason, thanks. I think I spotted my mistake. I've got a opening on Monday to try the firewall again.

I forgot to mention, we do have 2 older SIP phones that cannot use the SBC controller so would I need to setup NAT for them?

Benito

 

[benitok]

Still having problems with the firewall and 3CX.

I've configured a Network Definition for our 3CX Cloud Server Public IP and hostname.


I've also configured Service Definitions for in a group called 3CX_Group. TCP 5000, 5001, 5015, 5061. UDP & TCP 5060, 5090. UDP 9000 - 9500 and 48000 - 65535.


I then created a firewall rule to allow service 3CX Group from internal network to our 3CX Server.


If I look at the log files it shows the rule being applied and access was given, but nothing works.

SBC log


3CX Winows client


3CX Server login




I see that the port being sent from the client side is totally different. Any advice would be appreciated, thanks.

 

[benitok]

When I say nothing works,

I cannot access the 3cx sever web console.
The 3cx widows clients cannot register.
The 3cx SBC and phones cannot connect.

Thanks,
Benito

 

[benitok]

I don't recall adding this, but on Interfaces & Routing -> Interfaces -> Additional Addresses -> my 3CX server was added to the PPPOE connection. Once I removed it, I could access my 3CX Server in the cloud. My 3CX windows clients, SIP phone can register and connect.

I can make a phone call, but no audio. I assume this is to do with the NAT setup. I only configured Network Protection -> NAT -> Masquerading -> (Network: Internal network, Interface: PPPOE interface).

Should I remove Masquerading and setup NAT?

 

[benitok]

Fixed. All working now. Masquerading settings was correct. I had RTP service incorrectly configured on TCP and not UDP. I've also added my 3CX server to the exception list of Intrusion Prevention.

Edit: So my problem was, I had no Masquerading and incorrect RTP service configured as TCP and not UDP.

 

[YiannisH_3CX]

Glad the issue is resolved and thank you for posting your solution