403 Error

[Larren Metz]

I updated the public IP address in the settings of the system (not sure if it was just coincidence or not) and now I am getting a 403 error when trying to access the web interface. Everything still works on the system currently but it will not let me in the interface through local connection on the PC or remote connection. I am thinking I should reinstall the latest version but I wanted to see if something else could be figured out first. Thanks for your help!

 

[AWS2P]

it almost sounds like the nginx config has become fubar

As i can sleep with more knowledge,could you explain what "fubar" means? i've searched to translate in google with no result

 

[Larren Metz]

As i can sleep with more knowledge,could you explain what "fubar" means? i've searched to translate in google with no result

Haha. Just means it is messed up or corrupted.

 

[craigreilly]

out of working order; seriously, perhaps irreparably, damaged.

But - the actual letters translate to something on their own:

F***
Up
Beyond
All
Recognition

 

[Alphabetic]

Yes the https option is at the top of the config file

 

[Alphabetic]

Do you have shadow copies enabled on the pc you could try restoring that file? Are you doing a full imagine backup of that pc?

 

[AWS2P]

out of working order; seriously, perhaps irreparably, damaged.

But - the actual letters translate to something on their own:

F***
Up
Beyond
All
Recognition

Thanks Craig for subtitles

 

[Alphabetic]

Not familiar on how to dig down on Windows but I found an C:\Program Files\3CX Phone System\Bin\nginx\conf\nginx.conf file containing the following:

allow 192.168.0.0/16;
allow 172.16.0.0/12;
allow 10.0.0.0/8;
allow 127.0.0.1;
allow ::0/0;
deny all;

It seems it is correct in allowing. Do you think the server is calling the incorrect file? Where does it request this file in the system? Also, in your file does it have headers for https? Or only http header?

If you use notepad++ to open this file and from line 42-67 you should have the following:

Pay attention to change your FDQN

   server {
        add_header X-Frame-Options "SAMEORIGIN";
        listen 5000;
        listen [::]:5000;
        server_name <YOUR3cxFDQN>;
        server_tokens off;

        access_log off;
        error_log nul crit;

        allow 192.168.0.0/16;
        allow 172.16.0.0/12;
        allow 10.0.0.0/8;
        allow 127.0.0.1;
        allow ::0/0;
        deny all;

        client_max_body_size 300m;

        location /user_images {
            include "shared-headers.conf";
            expires 1y;
            add_header Pragma public;
            add_header Cache-Control "public";
            root "C:/ProgramData/3CX/Data/Http/wwwroot";
        }

Then lines 118-150

 server {
        add_header X-Frame-Options "SAMEORIGIN";
       listen       5001 ssl http2;
       listen [::]:5001 ssl http2;
        server_name  <YOUR3CXFQDN>;
        server_tokens off;

        access_log off;
        error_log nul crit;

        ssl_dhparam Instance1/dhparam.pem;
        ssl_session_cache shared:SSL:60m;
        ssl_session_timeout 1d;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;

        ssl_certificate      Instance1/<YOUR3CXFQDN>-crt.pem;
        ssl_certificate_key  Instance1/<YOUR3CXFQDN>-key.pem;

        ssl_ciphers  'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!ECDHE-RSA-DES-CBC3-SHA:!ECDHE-ECDSA-DES-CBC3-SHA';

        ssl_prefer_server_ciphers  on;

        client_max_body_size 300m;

        location /user_images {
            include "shared-headers.conf";
            expires 1y;
            add_header Pragma public;
            add_header Cache-Control "public";
            root "C:/ProgramData/3CX/Data/Http/wwwroot";
        }

Restart NGINX service.