3CX PBX firewall port list issue

[PeterCheng]

Hello sir,

I have issue regarding the explanation of ports used by 3CX.
UDP 9000-10999 ; 3CX Media Server (RTP) – WAN audio/video/t38 streams ; Yes – if you intend on using remote extensions, WebRTC or a VoIP Provider
7000-8999 ; 3CX Media Server (RTP) – LAN audio/video/t38 streams ; No - If you have strict routing on your LAN though, you must allow traffic from/to your 3CX server on there ports (Also applies to site-to-site VPNs)

I'm wondering how to distinguish WAN and LAN traffic?
If I use native windows app and in local LAN ( different networks to 3CX server but both in private network in the office ), will I use UDP 9000-10999 or 7000-8999 ?

We use cell phone application and native Windows APP at laptops, but we don't really know the traffic between client and 3CX server.
Would somebody can me a hand to solve my problem? Thanks.

Peter

 

[SteveITS]

Where is your 3CX server...in your office or hosted somewhere?

 

[PeterCheng]

Hello @SteveITS ,

Let me explain my environment：
We are using 3CX V18 update 3 with on premise linux platform.
We put the server at the DMZ zone in our office, and it is private network.

Thanks.

Peter Cheng

 

[NickD_3CX]

From the other parts of your network, you should allow both 9000-10999 and 7000-8999 for UDP to be able to reach the 3CX Server in the DMZ.

The same of course applies for the other ports as well.

[EDIT]
3CX decides which port range to use in many cases based on the IP address. If the IP is is RFC1918 range, then it will assume it's local and use the local port ranges.
When it comes to WebRTC though (WebClient, Desktop App, etc), even for "local" communication sometimes it may use the 9000-10999 range, that's why I suggest allowing that too.

 

[PeterCheng]

From the other parts of your network, you should allow both 9000-10999 and 7000-8999 for UDP to be able to reach the 3CX Server in the DMZ.

The same of course applies for the other ports as well.

[EDIT]
3CX decides which port range to use in many cases based on the IP address. If the IP is is RFC1918 range, then it will assume it's local and use the local port ranges.
When it comes to WebRTC though (WebClient, Desktop App, etc), even for "local" communication sometimes it may use the 9000-10999 range, that's why I suggest allowing that too.

Hi @NickD_3CX ,

Thanks fpor your explanation.
I think it' d be better to turn on UDP 7000-8999 and 9000-10999 at both sides.

Peter