403 Error

[Larren Metz]

I updated the public IP address in the settings of the system (not sure if it was just coincidence or not) and now I am getting a 403 error when trying to access the web interface. Everything still works on the system currently but it will not let me in the interface through local connection on the PC or remote connection. I am thinking I should reinstall the latest version but I wanted to see if something else could be figured out first. Thanks for your help!

 

[Evolute IT]

I updated the public IP address in the settings of the system (not sure if it was just coincidence or not) and now I am getting a 403 error when trying to access the web interface. Everything still works on the system currently but it will not let me in the interface through local connection on the PC or remote connection. I am thinking I should reinstall the latest version but I wanted to see if something else could be figured out first. Thanks for your help!

Sounds like you're trying to access the public IP via HTTP or the local IP via HTTPS. Only one or the other works.

 

[Larren Metz]

System Info: Windows 10 Pro, Lenovo ThinkCentre M73e, 320GB HDD and 8GB Ram

 

[Larren Metz]

Sounds like you're trying to access the public IP via HTTP or the local IP via HTTPS. Only one or the other works.

Thanks for your reply. I thought that too but I specified the ports for both. But I can try again.

 

[Saqqara]

As you have changed your public IP address, have you made the required changes on the firewall

 

[Larren Metz]

Connection times out remotely

As you have changed your public IP address, have you made the required changes on the firewall

Yes, I think it is something local because I cannot access 127.0.0.1:5001 as well when I am on the machine.

 

[Evolute IT]

Connection times out remotely


Yes, I think it is something local because I cannot access 127.0.0.1:5001 as well when I am on the machine.

5001 is the HTTPS port. In this case, 5000 is probably the HTTP one.

Locally, you can't access the HTTPS 5001. Only using the FQDN.

HTTP 5000 is local only. You have to use the private IP. Not the public one nor the FQDN.

 

[Larren Metz]

5001 is the HTTPS port. In this case, 5000 is probably the HTTP one.

Locally, you can't access the HTTPS 5001. Only using the FQDN.

HTTP 5000 is local only. You have to use the private IP. Not the public one nor the FQDN.

Yes I have tried both on the local machine. http://127.0.0.1:5000 and also https://127.0.0.1:5001 but the 403 Forbidden Error - nginx does not change. I cannot access the system anymore the way I did before.

 

[Evolute IT]

Yes I have tried both on the local machine. http://127.0.0.1:5000 and also https://127.0.0.1:5001 but the 403 Forbidden Error - nginx does not change. I cannot access the system anymore the way I did before.

127.0.0.1 is the loopback.

Try the private IP even on the same machine. Also, try "localhost" for fun. Still needs port.

 

[Larren Metz]

127.0.0.1 is the loopback.

Try the private IP even on the same machine. Also, try "localhost" for fun. Still needs port.

Same result. I don't think it is an address/route issue because the private ip did not change. And it is also giving me the forbidden error. Which is coming from the 3CX software. It seems to be blocking web interface access and I do not know why...

 

[Evolute IT]

Same result. I don't think it is an address/route issue because the private ip did not change. And it is also giving me the forbidden error. Which is coming from the 3CX software. It seems to be blocking web interface access and I do not know why...

Are you able to access it using the FQDN remotely?

Your IP might be blacklisted.

 

[Larren Metz]

Are you able to access it using the FQDN remotely?

Your IP might be blacklisted.

No I get the same error no matter how I try to access it. I am currently not able to manage this system at all. I can remote into the PC itself but cannot access the mgmt interface.

 

[Evolute IT]

No I get the same error no matter how I try to access it. I am currently not able to manage this system at all. I can remote into the PC itself but cannot access the mgmt interface.

I guess a reboot doesn't fix it.

What did you change for the public IP? Only the ISP's given IP? Did you change it in 3CX also?

 

[Larren Metz]

I guess a reboot doesn't fix it.

What did you change for the public IP? Only the ISP's given IP? Did you change it in 3CX also?

They were given a static IP so I went in to clear that error of IP Mismatch and now I am here! Not sure if it is related but just FYI.

 

[BrenttG]

it almost sounds like the nginx config has become fubar, might need to restore from backup, be easier than trying to manually fix the broken config.

 

[Alphabetic]

So out of curiosity I went to /etc/nginx/sites-enabled/3cxpbx and opened it up

Here I had the default values of:

server {
add_header X-Frame-Options "SAMEORIGIN";
listen 5000;
listen [::]:5000;
server_name FQDN;
server_tokens off;

access_log off;
error_log /dev/null crit;

allow 192.168.0.0/16;
allow 172.16.0.0/12;
allow 10.0.0.0/8;
allow 127.0.0.1;
allow ::0/0;
deny all;

When I hashed out the allow and restarted the NGINX server I got the 403.

When I unhashed and restarted service I got log in to MGMT console via 127.0.0.1:5000

 

[Larren Metz]

So out of curiosity I went to /etc/nginx/sites-enabled/3cxpbx and opened it up

Here I had the default values of:

server {
add_header X-Frame-Options "SAMEORIGIN";
listen 5000;
listen [::]:5000;
server_name FQDN;
server_tokens off;

access_log off;
error_log /dev/null crit;

allow 192.168.0.0/16;
allow 172.16.0.0/12;
allow 10.0.0.0/8;
allow 127.0.0.1;
allow ::0/0;
deny all;

When I hashed out the allow and restarted the NGINX server I got the 403.

When I unhashed and restarted service I got log in to MGMT console via 127.0.0.1:5000

Thanks for your reply. I am trying to find that in the files. Can you direct me on how to get there on windows pc?

 

[Alphabetic]

I’d hazard a guess and say c:\programdata

just do a search for the file name you should find it. Back it up first.

 

[Larren Metz]

I’d hazard a guess and say c:\programdata

just do a search for the file name you should find it. Back it up first.

Not familiar on how to dig down on Windows but I found an C:\Program Files\3CX Phone System\Bin\nginx\conf\nginx.conf file containing the following:

allow 192.168.0.0/16;
allow 172.16.0.0/12;
allow 10.0.0.0/8;
allow 127.0.0.1;
allow ::0/0;
deny all;

It seems it is correct in allowing. Do you think the server is calling the incorrect file? Where does it request this file in the system? Also, in your file does it have headers for https? Or only http header?

 

[Larren Metz]

it almost sounds like the nginx config has become fubar, might need to restore from backup, be easier than trying to manually fix the broken config.

Thanks for your reply. What is involved in repairing nginx config?