We have a 3cx standard cloud instance setup on AWS EC2. The 3CX has a trunk with our office PBX via a VPN between the EC2 and a server in our office.
The EC2 instance hosting the cloud 3cx has 2 network interfaces both with private IP addresses.
One is the default one by amazon facing the internet (and has the default gateway) (witch a 172.36.x.x ip) and the other is the VPN interface to our office (with a 10.50.x.x ip).
FQDN is set-up to map to the public ip of the EC2 instance
Internal extensions are 4xx
Numbers to the trunk are 1xx
We have the following problems:
- using the desktop windows app (v16.0.1.81) or android phone app (16.3.0.21) or IOS app we can make calls to internal extensions (4xx) but not to trunk (1xx) when client connect from a non-local office network
(clients configured to use 3cx tunnel connection in that case)
Using the webclient (webrtc) calls to 1xx work
Using a legacy 3cx windows client ( 6.0 version) calls to 1xx work (using tunnel connection)
Calls from 1xx to 4xx work on all clients
When using the client(s) on the internal office network calls to 1xx work
Looking at the SIP messages the answer from 3cx to the failed calls seems to be:
STATUS:603 Declined - "Caller is forbidden"
Looking at the SIP INVITE messages n each case shows only significant differences in the VIA Message Headers
VIA Headers for the clients that work (old windows client and webrtc client) show only 127.0.0.1 and/or public ip address of client
VIA headers for clients that do not work show also internal private network ip of client (prior to NAT)
Any clues ??
The EC2 instance hosting the cloud 3cx has 2 network interfaces both with private IP addresses.
One is the default one by amazon facing the internet (and has the default gateway) (witch a 172.36.x.x ip) and the other is the VPN interface to our office (with a 10.50.x.x ip).
FQDN is set-up to map to the public ip of the EC2 instance
Internal extensions are 4xx
Numbers to the trunk are 1xx
We have the following problems:
- using the desktop windows app (v16.0.1.81) or android phone app (16.3.0.21) or IOS app we can make calls to internal extensions (4xx) but not to trunk (1xx) when client connect from a non-local office network
(clients configured to use 3cx tunnel connection in that case)
Using the webclient (webrtc) calls to 1xx work
Using a legacy 3cx windows client ( 6.0 version) calls to 1xx work (using tunnel connection)
Calls from 1xx to 4xx work on all clients
When using the client(s) on the internal office network calls to 1xx work
Looking at the SIP messages the answer from 3cx to the failed calls seems to be:
STATUS:603 Declined - "Caller is forbidden"
Looking at the SIP INVITE messages n each case shows only significant differences in the VIA Message Headers
VIA Headers for the clients that work (old windows client and webrtc client) show only 127.0.0.1 and/or public ip address of client
VIA headers for clients that do not work show also internal private network ip of client (prior to NAT)
Any clues ??
