Block Extension from registering in App

[Yellow_Flash]

Hi,

We are using a 3CX V20 Debian install.

Is there a way to block the extensions from registering in the Android App?
During the covid time, we had provided everyone with access to Android App to make and receive calls.
Now, the organization wants all that access to be removed.
I remember that, before there was an option to block all registrations from outside the LAN, that seems to be missing now.
All i can see now is, "Block remote non-tunnel connections".
Even when i activate this option, the android app seems to be registering to the 3cx server. I believe it might be using tunnel connection?
Presence is working, they are able to make calls too..

The only other option i found is to disable external calls, but this isn't feasible as they wont be able to make calls from their office phones either.

Is there a way to block the Apps from registering or from making calls?

Thank you in Advance.

 

[Charles_3CX]

The option you are referring to is the same as what is currently in place, which is to block non-tunnel connections (meaning stun connections) from registering and to permit only tunnel connections. These are used for the 3cx softphone, mobile, and 3cx SBCs.

There are no settings to directly block mobile apps either on Android or iOS, but if you don't use any remote IP phones or softphones remotely outside of the same LAN where the 3cx system is installed, then you can consider blocking UDP and TCP ports 5090 to stop any tunneled apps like the mobile app, 3cx SBC, or v20 softphone from registering.

 

[Yellow_Flash]

Blocking the ports wont work, as there are few who works from home, so they need the access.
It is just that the vast majority doesn't need the access.
I dont remember correctly, but i believe it was V16 and previous versions where there was an option to block all registrations from outside, even the 3cx windows Apps didn't work when that option was turned on.
I'm not sure why this option was removed though, it seemed like a very sensible settings.
So now 3cx doesn't have a setting where you can restrict extensions from registering from outside and making calls?

 

[KyriacosS_3CX]

Hello,

It's not clear what the problem is - are they making calls out of hours? That can be stopped. If they are making calls over apps during office hours, well they can do them from deskphones as well. If we know exactly the issue perhaps a solution will be more obvious.

 

[Kevin Attard Compagno]

If you have "a few who work from home"...

...make sure they have a static public IP address, whitelist those IPs, and you can solve it that way?

 

[Yellow_Flash]

Hello,

It's not clear what the problem is - are they making calls out of hours? That can be stopped. If they are making calls over apps during office hours, well they can do them from deskphones as well. If we know exactly the issue perhaps a solution will be more obvious.

Hi,
Maybe i wasn't clear.
So, currently the situation is that everyone has access to 3cx Android App, and we want to remove this access for most of them.
The management doesn't want people to have access to calls when they are outside office. This means they shouldnt be able to view the call logs, voicemails etc.. and of course shouldn't be able to make and receive calls through the 3cx app.

At the same time, they shouldn't have any issue when they are in the office to make, receive calls through the Deskphone.
The App needs to be blocked/unregistered when they are outside the LAN network, to put it in simple terms.

 

[Yellow_Flash]

If you have "a few who work from home"...

...make sure they have a static public IP address, whitelist those IPs, and you can solve it that way?

Asking the employee's to have a static public IP doesn't sound like a practical solution.

 

[paulodagraca]

Hello Yellow_Flash,

You could "reset" the accounts.
Please note that if you reset the account ALL the passwords will change.

However, if the user will login via web (using email address) setting a new password, the web access will provide the QR code to scan and with that provide smartphone access again.
So this will only work if the users do not have web access / and no email setup on account to recover.

In general there is no option to disable the smartphone access.
If there is access to the QR code, the smartphone will work on the account.

Paulo

 

[Yellow_Flash]

Hello Yellow_Flash,

You could "reset" the accounts.
Please note that if you reset the account ALL the passwords will change.

However, if the user will login via web (using email address) setting a new password, the web access will provide the QR code to scan and with that provide smartphone access again.
So this will only work if the users do not have web access / and no email setup on account to recover.

In general there is no option to disable the smartphone access.
If there is access to the QR code, the smartphone will work on the account.

Paulo

Thanks for the input.
Yes, this is the exact thing I'm trying to find a solution for.
From what i can see, there is no way to really restrict the App usage, which atleast I feel isn't a very smart thing.
Admin should have access to block/Allow Apps that can be used by the users.