Toggle sidebar Toggle sidebar

Change port 9000

Status
Not open for further replies.

Oliver Broad

Free User
Joined
Feb 24, 2020
Messages
119
Reaction score
12
I'm trying to test a 3CX "box" in parallel with an existing system. I'd like to "nudge" the port 9000 block up to start at maybe 9010 to avoid conflict with the existing system.

I've seen instructions: https://www.3cx.com/community/threads/rtp-port-configuration.53768/#post-220669

but I don't actually know how to "stop the media server", and the numbers in my file look a bit different.

FEP = PT_INT32,9000
LEP = PT_INT32,10499

Also I can't help thinking those blocks are a bit big for my needs, probably less than 10 extensions.
 
Hi Oliver
This is the 3CX default range 9000 --> 10999 , so not sure at all you can do something to change this range, even with ten extensions .
Perhaps the simplest way to avoid conflicts should be to test it on different network
 
Last edited:
Hi Oliver,

Are you planning on forwarding UDP ports 9000 - 10999 on your firewall? If not then there is no point to change the ports at all.
 
Yes I am planning to forward them, unless there's a work-around that removes the need. I understand that they are required for anything that communicates off-site?

The existing system appears to only use 9000-9003 I think, I can check that. I can resolve the conflict with IP filtering, but it doesn't seem to be 100% reliable compared to using non-overlapping ports.
 
Hi Oliver

This can be done by changing a parameter called FIRSTEXTPORT and restarting your system. You will also be entering into an unsupported system scenario because we do not officially support changing those ports. The system assumes that the default ports will be used hence it may misbehave if you make changes. Do not run a production system with modified ports!

You will also need the entire RTP range, you have no way of knowing which ports the system will use at any given moment. Do not assume that you will not need the entire range - this will eventually lead to you aimlessly troubleshooting why your audio doesn't work. https://www.3cx.com/docs/ports/

If your existing PBX is using 5060, you cannot simultaneously assign this to 3CX. You must assign something else like 6060 for example - and only during the installation phase. We only support changing the the ports described in slide 16 here, and only during the installation phase
https://www.3cx.com/3cxacademy/videos/basic/installing/

As a last note, if you use a cloud based SIP Trunk, it would be a bad idea to register both your PBXs on the same provider at the same time. You may face issues with incoming calls.

I would highly recommend to watch our pre recorded webinars here, they will answer 9 out of 10 questions for 3CX beginners and can be a valuable tool for PBX veterans too.
https://www.3cx.com/3cxacademy/
 
Provisionally I've used 5160 and 5190. I'm aiming to get it to 100% pass the firewall test because I don't know enough to start leaving bits off. I have one static IP, so using a differnt IP probably isn't practical.

This isn't a "production" system though, this is a test box using a rather old PC that will almost certainly be replaced if we do opt for 3CX. Is port 9000 mandated somehow, like does a remote system, trunk provider etc expect to be able to call in on 9000 or is it negotiated?
 
Hi Oliver,

No problem, if your provider is ok with non standard SIP ports then 5160 should work ok for the testing phase. The RTP ports are negotiated in the SDP fields.
 
I'm beginning to suspect that the port numbers are a red herring, and there is something about the first test that makes it fail.

If I have no rules at all the test sometimes reports that the port 5160 was renumbered. Sometimes 5160 fails unreachable. If I put what I think is a valid rule then the first port test (5160) consistently returns "unreachable".

Every other test behaves as expected apart from some issues with old NAT sessions, but the first test keeps failling.

Oh for information the router is a Draytek 2760
 
The phenomenon you are noticing is due to the way your router handles NAT automatically when no rules are applied. As you have seen, it is not consistent.

We recommend that the ports be forwarded as full-cone NAT (whatever that translates to for each firewall manufacturer).

You can start from the below article, and also search the forum for the word Draytek to see how other members have configured theirs.
https://www.3cx.com/docs/draytek-firewall-configuration/
 
OK looks like I have some reading to do: I have the port forwarding part, but not the QoS parts because I based it on the existing setup and I don't think there was a QoS configuration for the old system.

I get the same result (5160 fail) with port forwarding set, and even with a "DMZ" configuration where all traffic that lacks a rule gets passed to the PBX. The DMZ configuration results in success on every other port.

I could switch out the router, I have a 2830Vn model available. I don't like the 2760, it appears to be intended as a home not office router and the feature set has been limited noticably.
Code: 
testing 3CX SIP Server... failed (How to resolve?)

    stopping service... done
    detecting SIP ALG... not detected
    testing port 5160... not reachable (How to resolve?)
    starting service... done

testing 3CX Tunneling Proxy... failed (How to resolve?)

    stopping service... done
    testing port 5190... Mapping does not match 5190. Mapping is 34630. (How to resolve?)
    starting service... done

testing 3CX Media Server... failed (How to resolve?)

    stopping service... done
    testing ports [9010..9408]... failed (How to resolve?)
        testing port 9010... Mapping does not match 9010. Mapping is 38450. (How to resolve?)
        testing port 9012... Mapping does not match 9012. Mapping is 38452. (How to resolve?)
        testing port 9014... Mapping does not match 9014. Mapping is 38454. (How to resolve?)
        testing port 9016... Mapping does not match 9016. Mapping is 38456. (How to resolve?)
 
Hi Oliver

From the results we see that the port forwards are not full-cone NAT (remapping takes place)

As for 5160 it appears to be closed completely (unreachable)
 
To clarify: that's the default - no rule - behavior. There is no rule configured to block 5160. I'll give it some time for the sessions to expire then I'll post the DMZ result.
 
OK I've configured 5160 UDP, 5190 TCP or UDP, and 9010 onward:

Also I'm aware that running it without a rule will fail, I'm interested in HOW it fails, I'd expect to see "mapping does not match" not "port unreachable"

Code: 
resolving 'stun-eu.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX SIP Server... failed (How to resolve?)

    stopping service... done
    detecting SIP ALG... not detected
    testing port 5160... not reachable (How to resolve?)
    starting service... done

testing 3CX Tunneling Proxy... done

    stopping service... done
    testing port 5190... done
    starting service... done

testing 3CX Media Server... done

    stopping service... done
    testing ports [9010..9408]... done
        testing port 9010... done
        testing port 9012... done
        testing port 9014... done
        testing port 9016... done
        testing port 9018... done
        testing port 9020... done
 
OK I ran an odd test: I set the media server to 5100 to force it to test a range of ports, no I don't intend to run it there, but every other number except 5160 got through at least partially. Today I had a moment of inspiration and googled port 5160, looks like I've picked a port that might have been blocked upstream.

Changed to 5180 and got a firewall checker pass. I can move on...

Correction: It stopped working shortly after. I've switched back to 5160:
 
Last edited:
  • Wow
Reactions: AWS2P
Code: 
resolving 'stun-eu.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX SIP Server... done

    stopping service... done
    detecting SIP ALG... not detected
    testing port 5160... done
    starting service... done

testing 3CX Tunneling Proxy... done

    stopping service... done
    testing port 5190... done
    starting service... done

testing 3CX Media Server... done

    stopping service... done
    testing ports [9010..9408]... done
        testing port 9010... done
        testing port 9012... done
        testing port 9014... done
        testing port 9016... done
        testing port 9018... done
        testing port 9020... done
        testing port 9022... done
        testing port 9024... done
        testing port 9026... done
        testing port 9028... done
        testing port 9030... done
        testing port 9032... done
        testing port 9034... done
        testing port 9036... done
        testing port 9038... done
        testing port 9040... done
 
And 5160 passed the test a couple of times then stopped. I seem to be up against some kind of firewall, but I'm fairly sure it isn't the router. The block seems to move to follow the port number I set.
 
I would pull out the Draytek and hook up my machine straight into the ISP box.

See what happens when I'm connected straight and with their NAT disabled.
 
That would mean the 3CX box acting as a PPPoE client. It probably can but the configuration's beyond me.
I'm thinking about trying a substitute router, possibly out-of-hours to avoid disruption. I'm also considering taking the box home and trying it there as I use a different ISP at home, and also I could use standard ports as there's no legacy system to work around.

I've already tried turning off firewall rules for the test duration, and there's a firewall test facility on the Draytek.
 
Yes, you can use a basic home-tier router to do the PPPoE for you, and just attach the 3CX box there.

Then you enable DMZ for the IP of the 3CX box, which will basically forward all traffic to it unaltered.

You will still have to disable any packet inspection or SIP ALG it may have just to be on the safe side, since every manufacturer may have a different implementation on how they handle these things
 
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
111,953
Messages
589,917
Members
164,851
Latest member
DrunkeMeister
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom