After latest 3CX update on debian 8 - android and iOS app can't connect - windows app wrong version

[itadmin-staff]

Hi all,
we just got the latest build of 3CX on our server, through apt upgrade, and it went from this :
3cxpbx/stable 15.5.8801.3 amd64 [upgradable from: 15.5.6354.2]

Since version 15.5.8801.3 (alias SP3 if we got it properly reading in forum here), everything works except that remote app on smartphone is just timing out.
Also, the windows application 3cx phone when starting, pop up a message stating that server version is different than client, and it can't work properly.

It seems that smartphone apps and windows apps require update to be compliant with 15.5.8801.3, but none of these app have update available.

Anyone else faced this issue ?
Thank you in advance.

Alexandre on behalf of IT group here.

 

[Marios Neophytou]

Hello @itadmin-staff ,

1. Can you tell us what version of clients (IOS/Android/Windows) are you currently running?
2. Did you firewall checker test pass without any failure ?
3. Can you check under the specific extensions if Tunnel is enable? Management Console > Extensions> Phone Provisioning > Network > Use 3CX Tunnel for remote connections (3CX Client only) . Also, If you are not using tunnel then make sure that "Disallow use of extension outside the LAN" under Extensions> Options > Restrictions is not checked.


Thank you

 

[itadmin-staff]

Hi Marlos,
Thank you for your answer.
So here are some informations :
- did run the 3cx firewall checker, i get a warning on "detecting sip ALG", which i guess i due to my iptables sip module. While i don't think it is related to the issue we have, regarding the version popup.
- Firewall checker also identified some port that were not mapped properly, i extended the range of ports to what was required (9000 to 9255 while previously i had only to 9100)
- I made sure that the option for the extension are ok, no issue here, obviously all of this was working just fine before the SP3.

So here is the message i have on iOS with the 3CX app, which is stating almost the same thing as on windows and android :


This thing above is my main issue.
Anything else is working, local phones, auto attendant, remote phones with SIP out of network, works good.

The app version i run on the screenshot above is the latest available on apple store which seems to be 15.2.12

On windows i am running the version 12.0.36097.670.

On android would be the latest from google play. All of them complaining about the thing above.

There is one thing we modified at some point, to avoid hacking, we did hide the version of 3CX because it was published and kind of exposing too much information online. Could this be related to that change ? ( 3CX Admin Interface -> Settings -> Parameters -> Type "USERAGENTSTRING" and set the value to "Unknown". ) we did not want the exact version and build exposed to avoid exploit and hacking.

 

[itadmin-staff]

Another note, the 3CX services seems to prioritize IPV6 over IPV4, but i don't use IPV6 yet, and it seems the reason why my tunnel is not connected, and probably my remote phones as well.

 

[Marios Neophytou]

Hello,

I have sent you a P.M

Thank you

 

[itadmin-staff]

Hi Marlos,
so as stated, and confirmed, the issue is the USERAGENTSTRING that had to be emptied in order for clients to work properly.
Is there a way for us to be aware when a fix is released for this ? we do not like the idea of having the full build exposed. We spoted the issue with shodan.io scan, and other security assessment tools.
While running the latest is not supposed to have any vulnerability, we want to stick to best practices.
Thank again for your feedback, so far, at least, our windows and smartphone apps are connecting fine.

 

[Marios Neophytou]

Hello,

Is your PBX behind a Firewall?
If yes then block any traffic from unauthorized IP to 5060 and allow only Providers, Stun extensions and so on.

Thank you

 

[itadmin-staff]

PBX is behind a firewall, but i have users all over the planet with remote phones (SIP+TLS) so blocking port 5060 and allowing dynamic IPs manually all around the place is not a game i want to play