Solved Cannot log in with FQDN but can login local IP address with SSL warning

[Varalino]

Phone system seems to work but can’t login to console with FQDN and I get a warning (redline through padlock symbol) that local connection is not secure when I login through the local IP.

Nslookup of the FQDN yields:
DNS server handling your query: localhost
DNS server's address: 127.0.0.1#53

Non-authoritative answer:
Name: <FQDN>
Address: <PUBLIC IP>

Cannot login with - https://<PUBLIC IP>:5001/

Router port forwarding
5001->5001
443->443
5015->5015
5060->5060
5061->5061
5090->5090
5228->5228
5022->5022
Also 9000:10999

Port 5000,5005, 5006 and 80 are forwarded to my network attached storage

 

[Saqqara]

This is correct, as you are connecting via ip and not fqdn, the ssl certificate is assigned to the fqdn of the server and not ip

You can connect to the http port of the server on the local lan, which will remove the ssl error.

To connect to the fqdn internally without the ssl error you need to setup on your dns server the fqdn address to point to the local 3cx IP address. You may also be able to setup a dns entry on the router to point the fqdn to the 3cx server Ip address

 

[Evolute IT]

Phone system seems to work but can’t login to console with FQDN and I get a warning (redline through padlock symbol) that local connection is not secure when I login through the local IP.

Nslookup of the FQDN yields:
DNS server handling your query: localhost
DNS server's address: 127.0.0.1#53

Non-authoritative answer:
Name: <FQDN>
Address: <PUBLIC IP>

Cannot login with - https://<PUBLIC IP>:5001/

Router port forwarding
5001->5001
443->443
5015->5015
5060->5060
5061->5061
5090->5090
5228->5228
5022->5022
Also 9000:10999

Port 5000,5005, 5006 and 80 are forwarded to my network attached storage

Don't share IPs publicly

 

[Varalino]

The issue is that the fqdn is not working. I can not log onto the console using the fqdn. Some of the user telephone apps work and some do not. It seems at the moment the users on T-mobile work and the users on Version do not.

Sorry about the IP share. Is there a way to delete the post and start over.

 

[Evolute IT]

The issue is that the fqdn is not working. I can not log onto the console using the fqdn. Some of the user telephone apps work and some do not. It seems at the moment the users on T-mobile work and the users on Version do not.

Sorry about the IP share. Is there a way to delete the post and start over.

You can edit your post.

As for your FQDN, are you using a 3CX one? And is your PBX cloud or on-premise?

 

[Varalino]

Yes using 3cx FQDN and yes the PBX is on premise.

Looks like i can edit my responses, but not the original post.

 

[Evolute IT]

Yes using 3cx FQDN and yes the PBX is on premise.

Looks like i can edit my responses, but not the original post.

When you say "cannot log", do you mean you get a "Invalid credentials" error or do you can't even get to the Login page?

 

[Varalino]

i can't get to the page. It times out trying.

I can ping the FQDN and it returns the correct WAN IP.

 

[Saqqara]

i can't get to the page. It times out trying.

I can ping the FQDN and it returns the correct WAN IP.

Are you on the same network as the 3cx server, or another external network. /

If you are on the same network, as per my previous post you need to setup a dns record on the local network to point to the 3cx internal IP address , so that ping fqdn returns the internal 3cx IP address. https://www.3cx.com/docs/creating-fqdn-split-dns/

Depending on your router, you may be able to configure Nat reflection (nat lop-back) which detects you are trying to access an wan ip and routes the traffic to the internal IP address

 

[Varalino]

Trying to access the 3cx console using the FQDN does not load the page (timeout). I get this same result when on the LAN with 3cx server, or another external network. I am unable to access the console using the FQDN. Proper operation of the user phone App seems to depend upon the carrier.

 

[NickD_3CX]

@Varalino

Answer this question first:

Are you on the same network as the 3cx server, or another external network. /

 

[Saqqara]

If you cannot access the 3cx server externally , check the following

1. Firewall port forwarding is setup for the correct port, correct internal IP address.

2. When you ping the fqdn externally does it resolve to the correct wan IP address. Do you have a fixed or dynamic IP address

3. Can you access the server using https port and local IP address (ignore ssl warnings) on the same network as the 3cx server

4 on the port forwarding info supplied you are forwarding both 5001 (3cx https port) and 443, what port did you select at the installation time

For internally see my previous posts

 

[Varalino]

Answer this question first:

Are you on the same network as the 3cx server, or another external network. /

As I stated above we have tried access both ways (on the same network as the 3cx server and from another external server) resulting in the page not loading when the FQDN is used. I can only access the console using the local IP when on the same network.


If you cannot access the 3cx server externally , check the following
1. Firewall port forwarding is setup for the correct port, correct internal IP address
2. When you ping the fqdn externally does it resolve to the correct wan IP address. Do you have a fixed or dynamic IP address
3. Can you access the server using https port and local IP address (ignore ssl warnings) on the same network as the 3cx server

Response:
1. We believe forwarding is correct (see details in original post). Also we are using the same ASUS router with the same port forwarding that previously worked with a different ISP. Could the problem be caused by the ISP?
2. FQDN ping form external network shows correct wan IP. I have a static IP now. Problem occurred when we moved the server from a previous ISP with a dynamic IP connection.
3. Yes, we can only access the server using https port and local IP address on the same network as the 3cx server

 

[NickD_3CX]

By the time you can access your 3CX Server from within the Local LAN using the IP, that tells me that the 3CX Services and Web Server are up and running.
If you can't access this same server from a remote location using the FQDN, which you confirmed resolves to the right Public IP Address, then my guess would be that the HTTPS port (default 5001) is not correctly forwarded to your 3CX Server.

 

[Saqqara]

Silly question , have you rebooted the firewall. It has been known to resolve some issues

Is there anything in the firewalll rules, that points to the old isp ip addrsss, that maybe blocking access

This will not resolve the current issue, within settings - networks have you changed your wan to be fixed and not dynamic

Using https://www.yougetsignal.com/tools/open-ports/ , does it say the https port is open

 

[Saqqara]

No console restrictions are in place https://www.3cx.com/docs/manual/pbx-management/#h.x1xh0oxyb7tk

 

[Varalino]

Thank you. I understand... I can not access the server with Https://<static IP>:5001, so it is not a FQDN problem it is a Firewall / port routing problem. I have checked the router setup and firewall many times, so I called the ISP and apparently the static IP has forwarding/routing rules setup wrong. They are working on corrections and I should know if that fixes it in a few hours.

 

[Varalino]

Silly question , have you rebooted the firewall. It has been known to resolve some issues

Is there anything in the firewalll rules, that points to the old isp ip addrsss, that maybe blocking access

This will not resolve the current issue, within settings - networks have you changed your wan to be fixed and not dynamic

Using https://www.yougetsignal.com/tools/open-ports/ , does it say the https port is open

Saqqara: Also Asked
No console restrictions are in place https://www.3cx.com/docs/manual/pbx-management/#h.x1xh0oxyb7tk

1. I have rebooted the router many times and the firewall is currently turned off.
2. Nothing in the firewall rules that points to the old isp that I can find and for debug it is turned off.
3. WAN changed to fixed. Problem occurred with same result prior to the change.
4. Using https://www.yougetsignal.com/tools/open-ports/; the tool says that the port is "closed". A scan of all common ports says that all ports are closed. ISP says they do not block ports.
5. No console restrictions currently in place.

ISP had the wrong router registered, but correction had not effect. I am still requesting ISP support to investigate the issue.

 

[NickD_3CX]

4. Using https://www.yougetsignal.com/tools/open-ports/; the tool says that the port is "closed". A scan of all common ports says that all ports are closed. ISP says they do not block ports.

I think this is the important thing, once this shows that the port is open, you should be OK.

Note: Make sure the 3CX Services are all running of course.

 

[Varalino]

How do I prove it's the ISP causing the block?

Also is seems strange that all of the ports are blocked, yet the 3cx is working with some (but not all) carriers.