3cx Mikrotik configuration

[Ravilla]

after i add step 3. ACL, i can't ping to my public ip. does it is impact?

 

[complex1]

Please PM me your firewall rules
ip firewall nat print
ip firewall filter print

 

[Yeison]

Hello Ravilla,

I remember some time ago I wrote the guide for the Mikrotik configuration so let me give you some guidance.

a. The steps 1 and 2. Will allow you to disable SIP ALG and to create the forwarding rules so when the traffic gets to the public ip address in the interface of the Mikrotik the router/firewall will forward it to the internal ip address of the 3CX. In this way, the firewall checker will pass and all the services like remote extensions, SIP trunks and so on will work.

b. The step 3 will allow you to create the rules to protect your router/firewall because it will create a rule that allows you to drop all the traffic coming from the internet however It will allow the traffic that belong to a session already established from within the LAN. In this way, the only traffic that will be accepted from the internet and will go directly to your LAN from any source will be the one that you configure in step 2 and it will be sent to the PBX. So, other people will not be able to access your devices from the internet.

c. Now, to answer the question that you said: I have the internet on the first interface and the switch connected to the second one. Then, you will need to:

- drop the traffic from the wan interface like this:

1. ip firewall filter add chain=input action=accept connection-state=established
   
2. ip firewall filter add chain=input action=accept connection-state=related
   
3. ip firewall filter add chain=forward action=accept connection-state=established
   
4. ip firewall filter add chain=forward action=accept connection-state=related
   
5. ip firewall filter add chain=forward action=drop connection-state=invalid
   
6. ip firewall filter add chain=input action=drop in-interface=ether1

-Create a nat rule so your lan (network in the second interface connected to the switch) will be able to go to the internet by using PAT like this:

ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

In this way when the devices from your lan (i assume ether2 has a private range) try to go to the internet the router will mask the private ip address with the public one.

PS: Thanks for contacting us. Your comments will help us to improve the guide!
Please do not hesitate to ask me if you need further information.

 

[Ravilla]

Hello Ravilla,

I remember some time ago I wrote the guide for the Mikrotik configuration so let me give you some guidance.

a. The steps 1 and 2. Will allow you to disable SIP ALG and to create the forwarding rules so when the traffic gets to the public ip address in the interface of the Mikrotik the router/firewall will forward it to the internal ip address of the 3CX. In this way, the firewall checker will pass and all the services like remote extensions, SIP trunks and so on will work.

b. The step 3 will allow you to create the rules to protect your router/firewall because it will create a rule that allows you to drop all the traffic coming from the internet however It will allow the traffic that belong to a session already established from within the LAN. In this way, the only traffic that will be accepted from the internet and will go directly to your LAN from any source will be the one that you configure in step 2 and it will be sent to the PBX. So, other people will not be able to access your devices from the internet.

c. Now, to answer the question that you said: I have the internet on the first interface and the switch connected to the second one. Then, you will need to:

- drop the traffic from the wan interface like this:

1. ip firewall filter add chain=input action=accept connection-state=established
   
2. ip firewall filter add chain=input action=accept connection-state=related
   
3. ip firewall filter add chain=forward action=accept connection-state=established
   
4. ip firewall filter add chain=forward action=accept connection-state=related
   
5. ip firewall filter add chain=forward action=drop connection-state=invalid
   
6. ip firewall filter add chain=input action=drop in-interface=ether1

-Create a nat rule so your lan (network in the second interface connected to the switch) will be able to go to the internet by using PAT like this:

ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

In this way when the devices from your lan (i assume ether2 has a private range) try to go to the internet the router will mask the private ip address with the public one.

PS: Thanks for contacting us. Your comments will help us to improve the guide!
Please do not hesitate to ask me if you need further information.

Hi Yeison,

Thanks you for your comment.
so i need to add this command in mikrotik right

Hello Ravilla,

I remember some time ago I wrote the guide for the Mikrotik configuration so let me give you some guidance.

a. The steps 1 and 2. Will allow you to disable SIP ALG and to create the forwarding rules so when the traffic gets to the public ip address in the interface of the Mikrotik the router/firewall will forward it to the internal ip address of the 3CX. In this way, the firewall checker will pass and all the services like remote extensions, SIP trunks and so on will work.

b. The step 3 will allow you to create the rules to protect your router/firewall because it will create a rule that allows you to drop all the traffic coming from the internet however It will allow the traffic that belong to a session already established from within the LAN. In this way, the only traffic that will be accepted from the internet and will go directly to your LAN from any source will be the one that you configure in step 2 and it will be sent to the PBX. So, other people will not be able to access your devices from the internet.

c. Now, to answer the question that you said: I have the internet on the first interface and the switch connected to the second one. Then, you will need to:

- drop the traffic from the wan interface like this:

1. ip firewall filter add chain=input action=accept connection-state=established
   
2. ip firewall filter add chain=input action=accept connection-state=related
   
3. ip firewall filter add chain=forward action=accept connection-state=established
   
4. ip firewall filter add chain=forward action=accept connection-state=related
   
5. ip firewall filter add chain=forward action=drop connection-state=invalid
   
6. ip firewall filter add chain=input action=drop in-interface=ether1

-Create a nat rule so your lan (network in the second interface connected to the switch) will be able to go to the internet by using PAT like this:

ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

In this way when the devices from your lan (i assume ether2 has a private range) try to go to the internet the router will mask the private ip address with the public one.

PS: Thanks for contacting us. Your comments will help us to improve the guide!
Please do not hesitate to ask me if you need further information.

Hi Yeison,

thanks you for your comment.
and follow that way even i have two sip ip address both will work?
now one of my sip is working and another one some call can get into pbx and some cannot.

Thanks.

 

[Yeison]

Hi Ravilla,

Please find my comments:

1. Yes. You are right. Those are the comments that you need to add to your router.

2. I think when you say two SIP ip addresses you mean two sip providers. So, if this is the case then the answer is Yes. In this way, basically you will be able to configure as many SIP trunks as you want.

Basically, it will work because you open the ports (with the port forwarding rules) 5060 tcp/udp and 9000-10999 udp to all the ip addresses so any provider will be able to send you traffic.

3. If one provider is not working I will advice you to do the following:
a. Is the provider registered (Do you see it in green in the management console?) If not then you will need to check what is happening: are you using the correct credentials, is your provider allowing you to register or is blocking your ip??... things like that

b. Now, if the sip provider is correctly registered then you need to check things like:
-Do you have problems just with: inbound, outbound or both calls?
-Now, you need to find the problem for this you will need to capture the traffic of a call with problems. You can try to do it yourself if not you can submit a ticket with us. In case you want to do it I can give you the following tips:

1. Start a wireshark capture as shown here: https://www.3cx.com/docs/capture-network-traffic/
2. Reproduce the problem (try to call until you got the error)
3. Download the capture to your computer
4. Open the capture with wireshark
5. Then click on Telephony->VoIP call
6. You will see a new tap with the list of the calls performed
7. Look for the call. Normally, you will see the same call 2 times. One from the phone to the PBX and another from the PBX to your voip provider
8. Select the call that belongs from PBX to provider and click on Flow
9. Try to look for any error thay may appear, like you send traffic to the provider but it never answer.. things like that.