3CX Phone 12 for iPhone - External Calls Forbidden

Discussion in 'iOS' started by convexserv, Mar 20, 2014.

Thread Status:
Not open for further replies.
  1. convexserv

    Joined:
    Nov 15, 2011
    Messages:
    5
    Likes Received:
    0
    Hello,

    I have a new install and I just set up 3 iPhones as extensions so that the user can make calls from outside the local network (primarily from home). The iPhone clients work fine when in the office, but when they are out of the office, they can not make outbound calls. The client comes back with "forbidden".

    The extensions have the "Disallow use of the extension outside the LAN" unticked.
    External IP is set to riverfrontdental.dyndns.org, internal is set to 192.168.1.5.
    Firewall checker passes all tests.

    This works wonderfully from my office, and the only thing I can see that is different is that I have a static IP at my office, and don't need to use a DDNS FQDN like I do at this location. Is the FQDN the issue? Am I missing something elsewhere?

    The activity log contains the following:
    19-Mar-2014 18:42:22.535 [CM504002]: Endpoint Extn:38: a contact is unregistered. Contact(s): [sip:38@127.0.0.1:5488 / 38]
    19-Mar-2014 18:42:17.682 Leg L:302.1[Unknown:] is terminated: Cause: BYE from PBX
    19-Mar-2014 18:42:17.633 [CM502001]: Source info: From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=Wkr3msUSMNcqydH6rJjV6Rir-6zxJWxZ; To: <sip:7328187704@riverfrontdental.dyndns.org:5060>
    19-Mar-2014 18:42:17.633 [CM503013]: Call(C:302): Incoming call rejected, caller is unknown; msg=Ivite-IN Recv Req INVITE from 100.1.140.123:5060 tid=PjuqB7zNimMFTOMLmT8GjPLRzUcPYfG1hr Call-ID=wolP6HrOmgrIT-NboqEzi3kkq3-Gv6F6:
    INVITE sip:7328187704@riverfrontdental.dyndns.org:5060;transport=UDP SIP/2.0
    Via: SIP/2.0/UDP 100.1.140.123:5060;rport=5060;branch=z9hG4bKPjuqB7zNimMFTOMLmT8GjPLRzUcPYfG1hr
    Max-Forwards: 70
    Route: <sip:riverfrontdental.dyndns.org:5060;transport=UDP;lr>
    Contact: "iPhone Rella"<sip:38@100.1.140.123:5060;ob;inst="3CF5E6">
    To: <sip:7328187704@riverfrontdental.dyndns.org:5060>
    From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=Wkr3msUSMNcqydH6rJjV6Rir-6zxJWxZ
    Call-ID: wolP6HrOmgrIT-NboqEzi3kkq3-Gv6F6
    CSeq: 11666 INVITE
    Session-Expires: 1800
    Min-SE: 90
    Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
    Content-Type: application/sdp
    Proxy-Authorization: Digest username="38",realm="3CXPhoneSystem",nonce="414d535c093aae4968:9a654d29b5830b572b4053bcc79728c2",uri="sip:7328187704@riverfrontdental.dyndns.org:5060;transport=UDP",response="bc8a99c7f29097c2c484bdbaa707553e",algorithm=MD5
    Supported: replaces, 100rel, timer, norefersub
    User-Agent: 3CXPhone for iPhone 12.1.1
    Content-Length: 313

    v=0
    o=- 3604257730 3604257730 IN IP4 100.1.140.123
    s=pjmedia
    b=AS:84
    t=0 0
    a=X-nat:5
    m=audio 4002 RTP/AVP 3 0 8 9 101
    c=IN IP4 100.1.140.123
    a=rtcp:4003
    a=sendrecv
    a=rtpmap:3 GSM/8000
    a=rtpmap:0 PCMU/8000
    a=rtpmap:8 PCMA/8000
    a=rtpmap:9 G722/8000
    a=rtpmap:101 telephone-event/8000
    a=fmtp:101 0-15
    19-Mar-2014 18:42:17.475 [CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:
    Invite-UNK Recv Req INVITE from 100.1.140.123:5060 tid=Pj00iPgpfsuu5qBtux2B-1OlIsXxSf.YcV Call-ID=wolP6HrOmgrIT-NboqEzi3kkq3-Gv6F6:
    INVITE sip:7328187704@riverfrontdental.dyndns.org:5060;transport=UDP SIP/2.0
    Via: SIP/2.0/UDP 100.1.140.123:5060;rport=5060;branch=z9hG4bKPj00iPgpfsuu5qBtux2B-1OlIsXxSf.YcV
    Max-Forwards: 70
    Route: <sip:riverfrontdental.dyndns.org:5060;transport=UDP;lr>
    Contact: "iPhone Rella"<sip:38@100.1.140.123:5060;ob;inst="3CF5E6">
    To: <sip:7328187704@riverfrontdental.dyndns.org:5060>
    From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=Wkr3msUSMNcqydH6rJjV6Rir-6zxJWxZ
    Call-ID: wolP6HrOmgrIT-NboqEzi3kkq3-Gv6F6
    CSeq: 11665 INVITE
    Session-Expires: 1800
    Min-SE: 90
    Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
    Content-Type: application/sdp
    Supported: replaces, 100rel, timer, norefersub
    User-Agent: 3CXPhone for iPhone 12.1.1
    Content-Length: 313

    v=0
    o=- 3604257730 3604257730 IN IP4 100.1.140.123
    s=pjmedia
    b=AS:84
    t=0 0
    a=X-nat:5
    m=audio 4002 RTP/AVP 3 0 8 9 101
    c=IN IP4 100.1.140.123
    a=rtcp:4003
    a=sendrecv
    a=rtpmap:3 GSM/8000
    a=rtpmap:0 PCMU/8000
    a=rtpmap:8 PCMA/8000
    a=rtpmap:9 G722/8000
    a=rtpmap:101 telephone-event/8000
    a=fmtp:101 0-15
    19-Mar-2014 18:42:01.721 Leg L:301.1[Unknown:] is terminated: Cause: BYE from PBX
    19-Mar-2014 18:42:01.672 [CM502001]: Source info: From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=n0g0PNULIr1Hnx756Owiju9aQDbgSJ52; To: <sip:16@riverfrontdental.dyndns.org:5060>
    19-Mar-2014 18:42:01.672 [CM503013]: Call(C:301): Incoming call rejected, caller is unknown; msg=Ivite-IN Recv Req INVITE from 100.1.140.123:5060 tid=Pj9zr8NhHMNWEx8NREMI4jgNDcUmcNzlW0 Call-ID=2FDXpvWFBRVzjX4pkeFcAaX986zX9UvT:
    INVITE sip:16@riverfrontdental.dyndns.org:5060;transport=UDP SIP/2.0
    Via: SIP/2.0/UDP 100.1.140.123:5060;rport=5060;branch=z9hG4bKPj9zr8NhHMNWEx8NREMI4jgNDcUmcNzlW0
    Max-Forwards: 70
    Route: <sip:riverfrontdental.dyndns.org:5060;transport=UDP;lr>
    Contact: "iPhone Rella"<sip:38@100.1.140.123:5060;ob;inst="3CF5E6">
    To: <sip:16@riverfrontdental.dyndns.org:5060>
    From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=n0g0PNULIr1Hnx756Owiju9aQDbgSJ52
    Call-ID: 2FDXpvWFBRVzjX4pkeFcAaX986zX9UvT
    CSeq: 11881 INVITE
    Session-Expires: 1800
    Min-SE: 90
    Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
    Content-Type: application/sdp
    Proxy-Authorization: Digest username="38",realm="3CXPhoneSystem",nonce="414d535c093aae3903:edcf48fa9c7f3abd9698ce1d1b1cc5ac",uri="sip:16@riverfrontdental.dyndns.org:5060;transport=UDP",response="aad647191bef8c538353f51ece53b3e4",algorithm=MD5
    Supported: replaces, 100rel, timer, norefersub
    User-Agent: 3CXPhone for iPhone 12.1.1
    Content-Length: 313

    v=0
    o=- 3604257714 3604257714 IN IP4 100.1.140.123
    s=pjmedia
    b=AS:84
    t=0 0
    a=X-nat:5
    m=audio 4000 RTP/AVP 3 0 8 9 101
    c=IN IP4 100.1.140.123
    a=rtcp:4001
    a=sendrecv
    a=rtpmap:3 GSM/8000
    a=rtpmap:0 PCMU/8000
    a=rtpmap:8 PCMA/8000
    a=rtpmap:9 G722/8000
    a=rtpmap:101 telephone-event/8000
    a=fmtp:101 0-15
    19-Mar-2014 18:42:01.584 [CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:
    Invite-UNK Recv Req INVITE from 100.1.140.123:5060 tid=PjDviRXuiMemVYdAXGBv2ZHQAzj.vNrYsP Call-ID=2FDXpvWFBRVzjX4pkeFcAaX986zX9UvT:
    INVITE sip:16@riverfrontdental.dyndns.org:5060;transport=UDP SIP/2.0
    Via: SIP/2.0/UDP 100.1.140.123:5060;rport=5060;branch=z9hG4bKPjDviRXuiMemVYdAXGBv2ZHQAzj.vNrYsP
    Max-Forwards: 70
    Route: <sip:riverfrontdental.dyndns.org:5060;transport=UDP;lr>
    Contact: "iPhone Rella"<sip:38@100.1.140.123:5060;ob;inst="3CF5E6">
    To: <sip:16@riverfrontdental.dyndns.org:5060>
    From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=n0g0PNULIr1Hnx756Owiju9aQDbgSJ52
    Call-ID: 2FDXpvWFBRVzjX4pkeFcAaX986zX9UvT
    CSeq: 11880 INVITE
    Session-Expires: 1800
    Min-SE: 90
    Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
    Content-Type: application/sdp
    Supported: replaces, 100rel, timer, norefersub
    User-Agent: 3CXPhone for iPhone 12.1.1
    Content-Length: 313

    v=0
    o=- 3604257714 3604257714 IN IP4 100.1.140.123
    s=pjmedia
    b=AS:84
    t=0 0
    a=X-nat:5
    m=audio 4000 RTP/AVP 3 0 8 9 101
    c=IN IP4 100.1.140.123
    a=rtcp:4001
    a=sendrecv
    a=rtpmap:3 GSM/8000
    a=rtpmap:0 PCMU/8000
    a=rtpmap:8 PCMA/8000
    a=rtpmap:9 G722/8000
    a=rtpmap:101 telephone-event/8000
    a=fmtp:101 0-15
    19-Mar-2014 18:41:52.616 [CM302001]: Authorization system can not identify source of: UnkSrc Recv Req SUBSCRIBE from 100.1.140.123:5060 tid=PjJtHNueXXhQvb-5JFpkZTCx1TbMGtL.rR Call-ID=SXIxdgmZluTrRPNSQKB-V0MU1dZXgSM9:
    SUBSCRIBE sip:38@riverfrontdental.dyndns.org:5060;transport=UDP SIP/2.0
    Via: SIP/2.0/UDP 100.1.140.123:5060;rport=5060;branch=z9hG4bKPjJtHNueXXhQvb-5JFpkZTCx1TbMGtL.rR
    Max-Forwards: 70
    Route: <sip:riverfrontdental.dyndns.org:5060;transport=UDP;lr>
    Contact: "iPhone Rella"<sip:38@100.1.140.123:5060;ob;inst="3CF5E6">
    To: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>
    From: "iPhone Rella"<sip:38@riverfrontdental.dyndns.org:5060>;tag=gb4YuW9OxeGLgwOFVEaNUCUmC2A6Gv1G
    Call-ID: SXIxdgmZluTrRPNSQKB-V0MU1dZXgSM9
    CSeq: 29104 SUBSCRIBE
    Expires: 3600
    Accept: application/simple-message-summary
    Supported: replaces, 100rel, timer, norefersub
    User-Agent: 3CXPhone for iPhone 12.1.1
    Event: message-summary
    Allow-Events: presence, message-summary, refer
    Content-Length: 0
    19-Mar-2014 18:41:52.423 [CM504001]: Endpoint Extn:38: new contact is registered. Contact(s): [sip:38@127.0.0.1:5488 / 38,sip:38@100.1.140.123:5060 / 38]
    19-Mar-2014 18:41:52.187 Got REGISTER for foreign registrar: registrar host <sip:mad:riverfrontdental.dyndns.org:5060> is not mine!
     
  2. leejor

    leejor Well-Known Member

    Joined:
    Jan 22, 2008
    Messages:
    10,878
    Likes Received:
    307
    Since it appears that you are using a Dynamic DNS service to reach the 3CX server location (riverfrontdental.dyndns.org), you must also have this information in 3CX as the Domain Name (Settings/Advanced/Settings for direct SIP calls), or calls will be rejected.
     
  3. convexserv

    Joined:
    Nov 15, 2011
    Messages:
    5
    Likes Received:
    0
    Thanks for the reply leejor,

    I do have riverfrontdental.dyndns.org set as the Local SIP domain, and I had already gone through the instructions for setting up the DNS records for direct SIP. If I look on my system (at my office), direct SIP is not even enabled, yet the 3CX phone app works perfectly out of the office. I have a static IP, my client doesn't.

    If the answer is that I need to tell my client to spring for a static IP address, that is fine with me. I just wanted to make sure that it was the culprit. I suppose I could try configuring the softphone with the current dynamic address, rather than using a FQDN.

    I will give that a try and report back.
     
  4. leejor

    leejor Well-Known Member

    Joined:
    Jan 22, 2008
    Messages:
    10,878
    Likes Received:
    307
    The 3CX server end does not require a static IP, I've run 3CX using a dynamic IP for a number of years, so no need to go to that expense. If the issue comes down to use of the FQDN in the server settings of the remote extension, and something set incorrectly in 3CX preventing this from working, then a test using the actual (dynamic) public IP,in the extension settings, and it works, may help pinpoint the issue.

    Adjacent to the Domain Name, in the PBX settings, did you tick the box...Allow direct SIP calls?
     
  5. convexserv

    Joined:
    Nov 15, 2011
    Messages:
    5
    Likes Received:
    0
    Yes, the checkbox is ticked.
     
  6. leejor

    leejor Well-Known Member

    Joined:
    Jan 22, 2008
    Messages:
    10,878
    Likes Received:
    307
    Have you tried calls from multiple remote locations?
    Have you confirmed that the originating IP is not in the IP blacklist?
    Have you confirmed that there is nothing in the outbound rules that might affect the call?
    Have you attempted remote extension calls from any other type of devices?
     
  7. convexserv

    Joined:
    Nov 15, 2011
    Messages:
    5
    Likes Received:
    0
    Leejor,

    First, thanks for all of your help.

    I changed the public IP address in Phone Provisioning from the dyndns address to the current public IP address, and it seems to have cleared up the issue. This is all well and good until our IP address changes, although it is not such a common occurrence on Cable.

    To answer your other questions:
    Have you tried calls from multiple remote locations? Yes, several, including 3G, and the homes of several employees.
    Have you confirmed that the originating IP is not in the IP blacklist? Yes
    Have you confirmed that there is nothing in the outbound rules that might affect the call? Not that I can see, but our inbound calls are coming in via a Patton gateway, not direct SIP.
    Have you attempted remote extension calls from any other type of devices? Yes. 3 different iPhones (iOS 6 and7) and an Android device.
     
  8. leejor

    leejor Well-Known Member

    Joined:
    Jan 22, 2008
    Messages:
    10,878
    Likes Received:
    307
    This would lead me to believe that the dyndns address that 3CX is receiving does not match the one that you have put in as the Domain Name. In this case registration attempts should also be failing.
     
Thread Status:
Not open for further replies.