3CX firewall checker giving errors

[ConvergiaDaniel]

Hi,
I’ve spoken with the team who manages our pfsense firewall here and we’ve opened all the necessary ports for the firewall checker, as listed below.
The machine is in a network where NAT does not take place. The IP of the 3CX installation is the public IP. We can control the ports that can reach that IP through the rules listed below:

Source = 192.8.XX.XXX.XXX:
-A FORWARD -s 192.8XX.XXX.XXX -p tcp -m multiport --dports 25,80,110,443,465,587,2195,2196,4505,4506 -j ACCEPT
-A FORWARD -s 192.8XX.XXX.XXX -p udp -m multiport --dports 53,123,5000:50000 -j ACCEPT

Destination = 192.8.XX.XXX.XXX:
-A FORWARD -d 192.8XX.XXX.XXX -p tcp -m multiport --dports 80,443,2195,2196,5061,5090,6274,9000:10999 -j ACCEPT
-A FORWARD -d 192.8XX.XXX.XXX -p udp -m multiport --dports 7,5060,5090,6274,5000:50000 -j ACCEPT

However, I’m still getting an error in the firewall checker UNLESS I open all ports on our firewall to this IP address.

I’m running out of ideas for which ports I need to open, all these ports are listed in the 3CX firewall configuration document online so… idk https://www.3cx.com/docs/manual/firewall-router-configuration/

I have also looked here and performed the checks as described. https://www.3cx.com/docs/firewall-checker/
Test 1 fails consistently, as seen in this packet capture:



Any help would be greatly appreciated,
Daniel

 

[cobaltit]

So if you aren't doing NAT I'm not sure why you would bother with firewalling. Just let pfsense route and firewall the host. But if you insist on continuing down this path it would be helpful to post which firewall tests are failing. Looking at your rules though I see a bunch of ports that aren't necessary for 3CX. But as far as ports that are necessary your 9000:10999 should be UDP not TCP

 

[JohnS_3CX]

As above, please post a screenshot of the failure messages

 

[ConvergiaDaniel]

Spent more time with our IT team testing port ranges. The source port 3478 was being filtered by our firewall, preventing communications from the 3CX firewall-checking servers from reaching my test machine.

Currently 54.39.182.217:3478 is allowed, but I will have to report back if other source addresses are also blocked.

Seems to be working fine though.


These were the firewall test failures for reference;

 

[JohnS_3CX]

Sounds like you are blocking outgoing traffic too.

The "not reachable" result means that the UDP RTP ports range is not actually open.

 

[ConvergiaDaniel]

5000-50000 UDP is open for source and destination during all my tests.

 

[JohnS_3CX]

What OS is your PBX running on and does it have anything at all installed other than 3CX and drivers?

 

[ConvergiaDaniel]

Debian 9 using the 3CX ISO hosted in Proxmox.
No, there are not other applications installed on my test installation.
No, Debian's nor Proxmox's firewalls are not getting in the way.

Because of our hosting network, we do not NAT for our hosted pbx installations. The port 'forwarding' I'm doing is allowing or disallowing port based on filter rules in pfSense.

I'll say it again, this is a network issue on my side. I will speak with my team about this.

Thank you for the responses

 

[JohnS_3CX]

Understood. Our installer takes care of the routing table too, so assuming you used our ISO it should take care of the OS-side routing accordingly during the installation and setup wizard phase. Hope it all gets sorted Daniel, let us know how it goes.