Solved 3CXTunnel.exe service stopping after IP blacklist

[BEAR.TECH]

So having an issue when our SOC blacklists a few IP's from 166.137.x.x in the USA with a bad reputation. This is not blacklisting on the PBX, but at our edge. As soon as it's blocked our 3CXTunnel service will stop. But I can immediately restart service...

1. Is this 3CX IP's?
2. If it is, why does 3CX need active communication with my tunnel? What if 3CX says eff telephony and closes shop. Does my tunnel just stop working?

Thanks for any insight.

 

[leejor]

Have you checked to see who the IPs are actually registered to? Unless you actually block the port used by the tunnel, or are blocking an IP used by your own (remote) devices, or provider, I fail to see why it would stop working .
3CX does have some communications with the PBX.

 

[BEAR.TECH]

Have you checked to see who the IPs are actually registered to? Unless you actually block the port used by the tunnel, or are blocking an IP used by your own (remote) devices, or provider, I fail to see why it would stop working .
3CX does have some communications with the PBX.

No ports are being blocked, just the IP addresses halted which immediately kills the service. The are random AT&T addresses in Wyoming and Colorado. No relevance to my users or network..

 

[BEAR.TECH]

Any other insight? Keeps happening. IPs get blacklisted on edge and SIP/RTP Tunneling Proxy service stops.... I do not have any SBC's out in the wild.

 

[ivank]

Any other insight? Keeps happening. IPs get blacklisted on edge and SIP/RTP Tunneling Proxy service stops.... I do not have any SBC's out in the wild.

Hi!
Could you switch logging into verbose mode and attach 3CXTunnel.log next time it happens?

 

[BEAR.TECH]

Hi!
Could you switch logging into verbose mode and attach 3CXTunnel.log next time it happens?

Thank you. Verbose turned on. Will update on next incident.

 

[BEAR.TECH]

Happened pretty quickly. This time nginx service stopped as well. The 3CXTunnel log is too big to attach so I've truncated it around the timestamp of the occurrence.

 

[leejor]

Looks to be extension 221, using a 3CX App on an iPhone, attempting to register.

 

[BEAR.TECH]

He's registering fine. Literally just made a call to his device. But yes the event is completely all about his extension! But I don't get how it's stopping PBX services when the connection is terminated??

 

[leejor]

Is this the only extension working remotely on a iPhone? If there are others, do they also have issues? Does the problem occur only with extension 221?

 

[BEAR.TECH]

This is the first time it's happened with verbose logging turned on so I can't speak to if he's the only one. Many of users on this system use iPhone softphones. I've had him remove the app from his device; will see if another instance occurs

 

[leejor]

You will need to see if there is a pattern. Same extension, originating from same provider, from iPhone App only.....

 

[BEAR.TECH]

So after having that user remove from his softphone, it hadn't happened again until today when another 2 others users used their softphone with same AT&T carrier and iPhone outside of the local network.

For whatever reason, the IP block AT&T is using for certain areas are known bad reputation, so my SOC is shutting down the tunnel service.

This is a non-issue as it turns out. Thanks for everyone's input.

 

[cobaltit]

So do you have software that is doing this automatically or is this a human that likes messing with your PBX?

 

[BEAR.TECH]

a bit of both?