Bug/Feature with newer iOS not connecting to locally hosted 3CX

[caldwell]

Inside a customer's building on their wifi and LAN, some users (especially news ones set up recently) have issues where the 3CX app on iPhone goes unregistered randomly.

I've verified the standard Apple "limit IP address tracking" is turned off. This WILL break split-DNS resolution on a local LAN. (Rules out their squirrelly, idiotic default settings.)

Turning off wifi and forcing cellular data ALWAYS fixes it. (Rules out "is the phone system up and connected to the LAN"?)

On desktop/laptops, the issue is that Apple has begun enforcing their own policy restrictions. I discovered this was the issue with Brave browser no longer being able to connect to the phone system until I would "allow Brave to discover devices on the local network." This is under Settings -> Privacy and Security -> Local Network -> Brave (turn on).

In researching this, guess what. Yes, they have a similar setting now on Apple iOS devices. Same thing: Settings -> Privacy and Security -> Local Network -> 3CX (turn on).

Mine was OFF. I'm not sure I ever was asked on the phone to allow this for 3CX App at any point. I asked one of the customer employees to check the same setting and to turn 3CX On. If her phone stays registered for a week, we have probably found the culprit.

For 3CX Developers, here's what AI said. I'm not sure if you are currently editing this .plist file to turn this Local Network access ON, but you probably should.

What to check​

To fix this, you must grant the permission on a per-app basis. Apple does not provide a global "Always Allow Local Network" switch for security reasons.
You can verify and change these settings here:

Settings > Privacy & Security > Local Network

If you are a developer or maintaining custom apps, you must ensure the Info.plist includes the NSLocalNetworkUsageDescription key with a purpose string. Without this, the system will effectively block your app from reaching the local subnet, regardless of your intent.

In a professional/IT environment, this creates a significant hurdle for managing internal infrastructure, but it is fundamentally a sandbox restriction baked into the OS. You are correct that it is the exact same "feature" (nuisance) present on macOS.

 

[Alphabetic]

I dont think this is your problem. This iPhone option allows apps to search the network for device discovery like printers and such.

3CX already know where to point to, doesnt go searching for PBX as the FDQN already resolves to its IP.

Have you checked you have split DNS configured correctly on your LAN?

https://www.3cx.com/docs/creating-fqdn-split-dns/

have you got anything on your LAN that could be routing/checking packets?

 

[SteveITS]

When it doesn’t work can the phone browse to the login page of the web client?

Slight digression…now and then we see networks where someone has configured Windows domain controller and external DNS. Windows does not necessarily use DNS in order, so only internal should be used, or a domain/host override created in the alternative DNS (if say a local router). IOW is only the desired DNS configured?

 

[caldwell]

I dont think this is your problem. This iPhone option allows apps to search the network for device discovery like printers and such.

3CX already know where to point to, doesnt go searching for PBX as the FDQN already resolves to its IP.

Have you checked you have split DNS configured correctly on your LAN?

https://www.3cx.com/docs/creating-fqdn-split-dns/

have you got anything on your LAN that could be routing/checking packets?

Yes, it is THIS setting that prevents Brave Browser installed as a WebApp from seeing the PBX on the local network. Allow "local network" access for Brave, and the WebApp begins working again immediately. Stands to reason it would affect any app attempting to connect to any device on the local LAN.

Considering split DNS has been set up for almost two years, and this only affects Macs and iPhones, I'd say it's related to the OS.

 

[caldwell]

When it doesn’t work can the phone browse to the login page of the web client?

Slight digression…now and then we see networks where someone has configured Windows domain controller and external DNS. Windows does not necessarily use DNS in order, so only internal should be used, or a domain/host override created in the alternative DNS (if say a local router). IOW is only the desired DNS configured?

DNS hasn't changed, and no, a web browser on a Mac can't hit the local LAN IP if this setting is not allowed/turned on. So, I'm presuming the same behavior on MacOS affects 3CX mobile app on iOS. We'll see. If it stays clean for a week, then this setting is the issue.

 

[Alphabetic]

Yes, it is THIS setting that prevents Brave Browser installed as a WebApp from seeing the PBX on the local network. Allow "local network" access for Brave, and the WebApp begins working again immediately. Stands to reason it would affect any app attempting to connect to any device on the local LAN.

Considering split DNS has been set up for almost two years, and this only affects Macs and iPhones, I'd say it's related to the OS.

Yes, actually it looks like you're right.

https://support.apple.com/en-gb/102229

 

[caldwell]

Well, there you have it in black and white. It would be nice for someone at 3CX Dev to confirm they know about this and are writing up an appropriate "in app display" that says something like, "In order for 3CX Mobile App to work with your locally hosted PBX, it needs to access the local network" and have two buttons: Allow, Allow.

 

[Alphabetic]

@Vali_3CX

 

[SteveITS]

Settings -> Privacy and Security -> Local Network -> 3CX (turn on).

Mine was OFF. I'm not sure I ever was asked on the phone to allow this for 3CX App

My phone does not have that setting because 3CX is not listed on that screen (only a few others). I would guess, it is listed when it asks the first time...?

 

[Alphabetic]

My phone does not have that setting because 3CX is not listed on that screen (only a few others). I would guess, it is listed when it asks the first time...?

I dont have it either.

It must do it as it attempts to access LAN stuff. And unfortunately, I dont have a PBX on LAN to test.