3CX vs Windows Firewall : 3CX Wins !!

[itgs]

I have a really strange issue that I was not able to solve / understand...

I have a 3CX V15.5 running on a Windows Server 2012 R2 (Virtual Machine) hosted in a cloud provider.
Server have a public ip address assigned directly on the server nic (no nat).
Several remote extensions register regularly and work fine.

In last week, I noticed an increase of failed registration attempt from strange ip address.
So I decide to modify the default firewall rules, created by 3cx installer, adding the scope with known ip address, to block this attempt.

First of all, I tried simply to change the standard "3CX Phone System Server TCP IN" rule (that permit incoming connections on tcp port 5060,5061,5090) blocking all connections.
I made that only to check if that approach was ok for my purpose.

With my surprise, nothing happens. All extensions still remained registered.
I would have expected that all extensions go down!
I tried to restart some extension in the remote office but they are registered regularly.

I thought there might be some problem with windows firewall.
So i change the "3CX Phone System Web Server HTTPS-IN" rule to block connection to verify windows firewall functionality. In that case, management console stop to respond correctly.

At that point, I was really confused so I tried another "drastic" test:
I modified ALL firewall rules (except web server) related to 3CX to BLOCK connections.
Guess what... ?!?! Nothing happened ! All extensions remain registered !!

I don't know what to do now.... have you any ideas ?!?!

Thank you for support

 

[totalitc]

Hello.

I have exactly this problem. Did you ever make any progress with this?

Regards

 

[itgs]

Unfortunately, no.

And the fact that nobody reply to my post, is not good...

 

[totalitc]

Great!

I'd open a case with support - if they hadn't changed the requirements so we don't qualify anymore!

 

[YiannisH_3CX]

Hello,

I have not tested this nor i am an expert on how the windows firewall works but this looks like a windows firewall issue, not a 3CX issue. What i would recommend is running a wireshark capture while having the ports blocked on the machine. Are the phones registering on 5060? You will be able to see the attempts as wireshark captures traffic at the NIC level so all incoming packets will be visible even if blocked by the windows firewall.

If phones register on the block ports then the issue is related to the windows firewall. The correct way to be secure is to put the PBX behind a firewall and do all filtering through that.