3CX STUN servers for the Firewall checker

[alextannenbaum]

Hello,

Is there an updated list of 3CX STUN server IP addresses that the firewall checker uses? We would like to avoid exposing SIP to the world and instead restrict it to our SIP providers and the 3CX servers. I had this working before but now the firewall checker fails so I think the IP addresses might have changed.

Thank you

 

[ChrisC_3CX]

There is no list or FQDN to cover all STUN servers but you could perhaps get some IPs from the FQDNs seen on your PBX while running the firewall checker, and then perhaps perform a packet capture while running the firewall checker to grab the rest. That said, the IPs used may change at any moment without warning so this might not be a permanent solution.

What I'd recommend instead is that you lift all SIP restrictions, pass the firewall checker and lock down your network again. Provided the configuration for the SIP traffic is done correctly for your SIP Providers, you should've have any issues. Only case you might need to run the firewall checker again is if we release an update that requires it or you have a 3CX Support case during which this is requested, in which case, you can just temporarily lift restrictions for the duration of the support case.

EDIT: Also, if the PBX is set with a dynamic public ip then the stun servers are actually used for external calls too so you should keep this in mind in case you are using a dynamic ip and have issues with calls or audio.