Solved Cannot pass firewall test.

[cjferoussis]

Hello everyone! We need some help regarding the firewall test.
We get the following results:

• resolving 'stun-eu.3cx.com'... done
• resolving 'stun2.3cx.com'... done
• resolving 'stun3.3cx.com'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX PhoneSystem 01 SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... not detected
  • testing port 5060... full cone test failed (How to resolve?)
  • starting service... done
• testing 3CX PhoneSystem Media Server... failed (How to resolve?)
  • stopping service... done
  • testing port 5090... done
  • testing ports [9000..9398]... done
    • [...]
    • testing port 9398... done
  • testing ports [10600..10998]... failed (How to resolve?)
    • testing port 10600... full cone test failed (How to resolve?)
    • [...]
    • testing port 10998... full cone test failed (How to resolve?)
  • starting service... done

3CX Version; Standard Annual18.0 (Build 23) On-premises
Server OS Win 10 (I know, I work with what I have)
ISP: Cosmote Athens Geece

The system works well with phones and apps (both in and out of the office) but there is no sound in the live chat (call us function) from our website.
Wireshark seems to show that the server tests 5060 two times. The first time there is a response but not on the second.

There should be no problems regarding port forwarding.

Also, the systems won't show me any way to update to v20.

Could someone help??
Thanks in advance

 

[bitn2]

Your portforwarding ist wrong. You missing alot of ports. Please check: https://www.3cx.com/docs/manual/firewall-router-configuration/

 

[TheodorosG_3CX]

If i understand correctly from the screenshots you are failing on the first test as well, besides the port configuration missing.
While the 1st test requires to Not Set, the firewall does change the ip on the response.
Check the guidelines below and proceed from there:
• https://www.3cx.com/docs/manual/firewall-router-configuration/
• https://www.3cx.com/docs/firewall-checker/

 

[cjferoussis]

Thank you all for your responses!
The port forwarding was good; the problem relies upon the ISP.
Cosmote (Greece) blocks 5060 for SIP and 10000-12000 (confirmed by Cosmote and the router manufacturer, Oxygen).
We changed SIP and WEB RTC ports and passed the firewall test.
For some other reasons, we had to change again back to 5060 for the time being.
Everything works as it should except for the "callus" button from LiveChat. There is no audio delivery (only when calling directly from the website). Is this related to 5060?

Thank you again for your help!

EDIT:
*There was no audio delivery even when we had passed the firewall test with SIP port on 6050

 

[TheodorosG_3CX]

As you can also see in the guideline for the live chat:
"You can give visitors the option to also call you - in this case the user will connect to 3CX directly without dialing a number. A browser connection will be established using WebRTC. You can allow a visitor to call you without initiating a chat first."
Meaning that you need to allow UDP for the WebRTC in the range of 9000-10999

 

[cjferoussis]

Thank you for your response!

Problem solved, now everything seems to work correctly even with 5060 blocked.
As I mentioned, we changed the WebRTC ports to 15000-15499. We also mistakenly forwarded only 15100- 15498. Now we forwarded all of them and everything works correctly!

Things to keep in mind for guys like me, that are not familiar with the system (might be correct or not, they worked for us):
1. Not all ports that are set are being tested by firewall test (ergo the mistake we made with the port forwarding).
2. When restoring the system from a backup where you have changed the port settings, you need to make the same changes again as they are not stored in the backup (at least this is what happened in our case)
3. When port forwarding some port range (eg 15000-15499) add one port to the start and one to the end -> 14999- 15500. In our case, there was a one-way sound transmission problem, and we solved it that way. This probably is related to the router used, in our case Oxygen by Cosmote (GR)

Thank you all for your help!

 

[TheodorosG_3CX]

@cjferoussis Glad to know the issue is now resolved.