Annoyed by Firewall Test Fails

[ajohnson443]

My system has been working fine for a while, never have any issues with dropped calls or audio etc.. But the RED Exclamation for the firewall test is annoying me to death lol! ALL the ports are open but some ports always fail (randomly) during the test.. Any idea how to resolve? Or should I just get over it? lol

Router:
Nighthawk(R) X4S R7800
Firmware Version V1.0.2.68


Firewall test results (removed the passing ports for brevity)

• resolving 'stun.3cx.com'... done
• resolving 'stun.callwithus.com'... done
• resolving 'stun.sipgate.net'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX SIP Server... done
  • stopping service... done
  • detecting SIP ALG... not detected
  • testing port 5060... done
  • starting service... done
• testing 3CX Tunneling Proxy... done
  • stopping service... done
  • testing port 5090... done
  • starting service... done
• testing 3CX Media Server... failed (How to resolve?)
  • stopping service... done
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9018... full cone test failed (How to resolve?)
    • testing port 9020... full cone test failed (How to resolve?)
    • testing port 9066... full cone test failed (How to resolve?)
    • testing port 9068... full cone test failed (How to resolve?)
    • testing port 9072... full cone test failed (How to resolve?)
    • testing port 9074... full cone test failed (How to resolve?)
    • testing port 9076... full cone test failed (How to resolve?)
    • testing port 9078... full cone test failed (How to resolve?)
    • testing port 9208... full cone test failed (How to resolve?)
    • testing port 9222... full cone test failed (How to resolve?)
    • testing port 9228... full cone test failed (How to resolve?)
    • testing port 9230... full cone test failed (How to resolve?)
    • testing port 9232... full cone test failed (How to resolve?)
    • testing port 9234... full cone test failed (How to resolve?)
    • testing port 9290... full cone test failed (How to resolve?)
    • testing port 9296... full cone test failed (How to resolve?)
    • testing port 9320... full cone test failed (How to resolve?)
    • testing port 9324... full cone test failed (How to resolve?)
    • testing port 9332... full cone test failed (How to resolve?)
    • testing port 9334... full cone test failed (How to resolve?)
    • testing port 9346... full cone test failed (How to resolve?)
  • testing ports [10600..10998]... failed (How to resolve?)
    • testing port 10696... full cone test failed (How to resolve?)
    • testing port 10786... full cone test failed (How to resolve?)
    • starting service... done

 

[JohnS_3CX]

Hi @ajohnson443

Does your firewall documentation contain information about how to open ports as full cone NAT?

Also the complete range of our media server 9000-10999 but the screenshot of your rules does not seem to cover all ports https://www.3cx.com/docs/ports/

 

[eddv123]

Although completely obvious, surely just replicate what you have done for 5060 and 5090 (since they look to have passed - although I cannot see the colours) for the media port range.

 

[ajohnson443]

Hi @ajohnson443

Does your firewall documentation contain information about how to open ports as full cone NAT?

Also the complete range of our media server 9000-10999 but the screenshot of your rules does not seem to cover all ports https://www.3cx.com/docs/ports/

I only included the failed ports in the report. Everything else passes. The failed ports are random, not always the same ones..

All the required ranges are open/forwarded in the firewall settings.

I wonder if it is a time-out issue the part of the tester?

I can't post the full test due to too many characters so I attached a text file. Notice this time 5060 failed too.. See what mean about random? The system works fine.. this is just annoying.
I am OCD about that darn little on my dashboard

 

[aberry]

I've had the same issue at some site. I just ignore it and everything works fine. Honestly, it just matches my non supported SIP trunk ! and my non supported phones !

 

[ajohnson443]

Hi @ajohnson443

Does your firewall documentation contain information about how to open ports as full cone NAT?

Also the complete range of our media server 9000-10999 but the screenshot of your rules does not seem to cover all ports https://www.3cx.com/docs/ports/

I just re-did all the port forwarding using the chart you linked to.. Consolidated TCP, TCP/UDP, & UDP into single entries to make it easier to look at

 

[cobaltit]

But did the firewall checker pass?

 

[ajohnson443]

But did the firewall checker pass?

Nope - still has random failures

 

[JohnS_3CX]

Can't say about the specific firewall as we do not provide support on those, but depending on the model/vendor and depending on how strict your rules are (with regards to the PBX being allowed to contact the 3CX firewall checker server IPs) you might have inconsistent results.

I believe if it supported full NAT you would not have the intermittent/random failures. You can of course hook up the PBX straight into your modem/CPE with DMZ mode enabled for the PBX machine's private IP and see if the issues go away (to pinpoint the router as a possible cause)

 

[ajohnson443]

I already have a DMZ server for something else and I'm not going to upset the apple cart just to satisfy my OCD

Ran a test with an analyzer online.. NAT all seems to be setup correctly.

Here are the results of the test:

UPnP Test (?):	No UPnP device found
STUN Test (?):	Full Cone NAT
UDP Binding Test (?):	Endpoint independent binding, port prediction is easy
TCP Binding Test:	Endpoint independent binding, port prediction is easy
UDP Mapping Test (?):	your external IP address was different from your local one (NAT). Your external source ports were preserved on every connection.
TCP Mapping Test:	your external IP address was different from your local one (NAT) Your external source ports were preserved on every connection.
SIP ALG (?):	The initial SIP INVITE packet has not been modified on its way to our servers. There is no SIP ALG involved
FTP ALG:	The initial FTP PORT command has been modified. Most probably, your NAT implements a FTP-ALG
UDP Hole Punching (?):	High TTL Test was not successful
	Low TTL Test was successful
	Silent Test was not successful
TCP Hole Punching:	High TTL Test was not successful
	Low TTL Test was not successful
	Silent Test was not successful
UDP Timeout (?):	Your UDP timeout is approx. 32 seconds There should be no problem when refreshing bindings.m

 

[JohnS_3CX]

You're still failing the full cone tests, that 3rd party test does not check the specific things 3CX does.

You can continue to use your system by all means, but I would expect that at some point external calls may show issues or they may have problematic audio and you will have to come back to this.