Changing the 3cx default ports

[Moawia Noor]

Tomorrow we upgrading an H.O 3cx server from 14 to 15.5, we are aslo willing to change 3cx default ports, reason behind is to avoid ISP blocking sip traffic.

Did anyone try the same scenario? Did it work ? Can we go back to default ports if things went ugly ?

 

[leejor]

Which port(s) are you planning on changing?

https://www.3cx.com/docs/ports/

 

[Moawia Noor]

Hi leejor , 5060, 5061 and 5090

 

[leejor]

Haven't had to do that myself, but from what I've come across, they can be set during the initial installation (and you will probably find out before you have to apply the back-up from previous version). If you decide to change them again, a re-installation is required. This may have changed on a recent update. I'm sure that someone can confirm.

 

[Moawia Noor]

We are really hoping if we can avoid reinstalling in case of going back to default ports, our down time is limited. Let's t just wait for a second opinion . Thanks for responding.

 

[eddv123]

Personally I would stick to the default ports as and when possible.

I have changed ports on v14 before and this was fine, however if find v15 must more sticky in regards to this sort of thing, for example you used to not be able to change the local IP address without re-install, this has now been solved however.

 

[YiannisH_3CX]

Hello @Moawia Noor

Please note that the SIP port and tunnel port can be configured during installation however if you need to revert to the default ports then you will need to re-install the system as in the latest version you cannot change the port after the system has been installed

 

[Moawia Noor]

Ok, we did change only the tunnel port, felt challenging to change them all.
Upgrade and backup restore were successful.
The firewall test is failing to approve the new port we've configured for the tunnel, though it's working.
and 3cx mobile apps using different ISP were able to register and making calls
changing the tunnel port didn't fix the ISP blocking issue.

Finally, I think the firewall test is unable to test but the default port 5090, other's might not be supported. And ISP is blocking more than the tunnel port.

 

[leejor]

Out of curiosity, more than anything...Is having to deal with an ISP that is blocking ports you wish to use because of the lack of alternatives, or is it a backward government requirement of some sort, that all ISPs have to follow (blocking VoIP) ?

 

[Moawia Noor]

@leejor.Ok, there is basically 4 ISP's out there, 3 of them are blocking VOIP traffic "because they can", the government is not involved at the matter, companies are trying to make more money by blocking free VOIP calls fo any kind.
one ISP is new, it's the only one which is not blocking the VOIP traffic, but no one is using their services, and maybe they don't know what they are doing, and they are just allowing the traffic by mistake.
The good thing that all the blocking is for individuals, they are not blocking the Bussiness customers, so you will be able to setup VOIP and use it between business remote locations but not for remote home users.
We are asking users to connect through VPN, which sometimes works, but most of the time, the users are irritated and end up neglecting the feature.

I'm really surprised that no one has tried to change the ports, at least as a security precaution or any Geeky reason.

 

[complex1]

Hi,

On every PBX I install I always change port 5060 and 5061 into a other port number.
Never get any warning messages of possible attacks or other port scans.
After change these ports, don't forget to change the firewall ports because they are on default port numbers.
Then run the firewall checker and all tests are passed.

Happy?

 

[Moawia Noor]

Actually, I'am

have you tried to change port 5090 as well? because I'm 100% sure my port mapping is right. Still, firewall checker didn't approve it. though all the rest "default ports" passed the test.

Thanks

 

[complex1]

Never had the need to change port 5090 into something different.
5090 is used as tunnel port so I've leave it unchanged.

 

[YiannisH_3CX]

The firewall checker should check the ports selected during the installation. If you are installing on Linux and not using the 3CX iso then you should probably check the IP tables as well.

 

[complex1]

@YiannisH_3CX, Not quite right…

I install 3CX on Linux always using the 3CX iso and after installation I have to modify the IP tables with the changed SIP ports. Settings in IP tables do not follow the SIP port change during installation. I wish it did.