connect remote user SNOM300 phone to 3cx using port forward

[russellcrowe]

Hi

need to know how to connect remote user Snom300 phone to 3cx phone system without going through a vpn

e.g the problem we have is QOS on home users.
the home user will have just 1 adsl line for voip and data
we normally use draytek routers and this supports QOS
so if we can set up phone to work using ports then we can control bandwith.
to control bandwith in a vpn for single remote users is very expensive to do.

what ports would we need to open at the office /3cx server firewall

thanks
russell

 

[Discovery Technology]

Sonicwalls can be a little tricky with 3CX as they like to mangle the RTP packets (ie: what goes in via the LAN interface doesn't necessarily go out on the WAN interface on the same port number...) - have you switched on 'use SIP transformations' in the Sonicwall GUI under the VoIP settings? (this can help)

You may even want to enable 'use symmetrical RTP' in the 3CX GUI

Did you try the outbound proxy setting in the phone to see if this would help?

Both of those firewalls should support IPSEC VPN which could also get you out of trouble...

 

[russellcrowe]

thanks

what do i need to change on outbound proxy setting on phone?

i will try those settings

we were using vpn and this works ok
but if you have home user with 1 adsl line for voip and data then if using vpn very difficult to control QOS for voip
and call quality is no good.

so i thought if i could get port forwarding working then devices like draytek and sonicwall have qos that works ok with port forwarding

i will let you know how testing goes
russell

 

[Discovery Technology]

Hi Russell,

You can still setup QoS rules through the tunnel using the TZ180 - these are in the form of allow rules from the VPN zone to the LAN zone - I usually only bother with the RTP traffic (7000 - 7499 in this instance) as SIP itself doesn't really need to be prioritised, but doing so would simply involve adding another line in the firewall allow rules section.

The trick of course is to define these services first, then setup the allow rules between zones from there.

Not so sure about the capabilities of the Draytek though. I have had SNOM phones and Yealink phones (as well as the Assistant) working well between a TZ170 and a PRO 2040 with no issues using IPSEC.

As far as the outbound proxy setting goes, just use the same (outside) IP as the SIP proxy setting for your 3CX Server

Otherwise, always happy to help someone famous 8)

 

[Duellbuell]

Russel,

Did you find a fix for the problem I'm experiencing the same issue.
But I use a Dlink router and no firewall.

Tnx

 

[russellcrowe]

Hi

no i have not got a snom phone working using port forwarding with 3cx
it nearly works
e.g from the 3cx server end you can call the remote snom phone
but the remote snom phone can not dial anything

i have been told issue is sonicwall but not sure i agree
russell

 

[comresource]

I have a snom300 on my desk right now registered with a remote client. Works both in and out. Nothing special about the setup, just add outbound proxy/stun server/keepalive.

Both Phone and 3CX are behind a Snagpear 560.

 

[russellcrowe]

you make it sound very easy
i have opened several ports and it still not work correctly

please let me know what ports need opening/forwarding
and what setting you need to put in snom phone

it all works ok through vpn

thanks
russell

 

[comresource]

you make it sound very easy
i have opened several ports and it still not work correctly

please let me know what ports need opening/forwarding
and what setting you need to put in snom phone

it all works ok through vpn

thanks
russell

I may have spoke to soon, I did a factory reset on it and manually set it up again and now having problems. It dials other extensions and outbound fine but calling it from other extensions is acting funky.

 

[russellcrowe]

i have done the firewall checker from the 3cx server and get this result

3CX Firewall Checker, v1.0. Copyright (C) 3CX Ltd. All rights reserved.

<21:36:39>: Phase 1, checking servers connection, please wait...
<21:36:39>: Stun Checker service is reachable. Phase 1 check passed.
<21:36:39>: Phase 2a, Check Port Forwarding to UDP SIP port, please wait...
<21:36:45>: UDP SIP Port is set to 5060. NO RESPONSE received. Phase 2a check FAILED.


Application exit code is -2

is this anything to do with my issue

not sure what the above means
i have opened port 5060 tcp and udp for incoming

thanks
russell

 

[leejor]

I would want to find out why the port 5060 test failed...that may very well be one of the problems
Since you've already tried to open up / forwarded ports 5060 and 9000 to 9015 at the 3CX end, it may not be working properly. I would also suspect that there could be a problem at the remote end. Normally, when using STUN at the remote end you can get away without having to do any port forwarding. A lot of us use both WiFi and/or Ethernet ATA's behind routers that we have no access to, to change options, generally with no issues. That said, there are routers/firewalls that will give you grief, and no matter what you do, it won't work properly. This may be that case, or it may just be a setting that needs to be changed. Since that remote extension isn't getting audio, it sounds like the router is blocking, or just not passing the audio packets. Do you have another router you can test with? If you are using STUN on the set (which you should be) you can leave it to pick up an IP using DHCP, if that option is already set you should be able to test using any old router that you happen to have access to.

 

[russellcrowe]

this is my setup so far

remote site Draytek 2820

phone ip 192.168.50.15
port forwarding tcp/udp 5060 to 192.168.50.15
port forwarding udp 9000 to 9050 to 192.168.50.15

3cx server end
sonicwall TZ180
port forwarding to 3cx server 192.168.10.12
for ports
tcp/udp 5060 and 9000 to 9050

i have not done any changes for outgoing rules on either firewall

i can not dial the remote phone from another extension
the remote extension does register with 3cx
and the remote extension can ring external numbers and they ring and answer but no voice

the equipment works ok through vpn between sonicwall and draytek
main reason i am attempting to get this to work is so that i can do QOS on the ports

if anyone has list of ports that need setting at each end it might be easier to start again

what stun server should i use in the snom phone?

also i am using a patton gateway with isdn for calls
so not using sip etc for calls
only for remote extension


thanks
Russell

 

[leejor]

remote site Draytek 2820

phone ip 192.168.50.15
port forwarding tcp/udp 5060 to 192.168.50.15
port forwarding udp 9000 to 9050 to 192.168.50.15

The 5060 port forward won't hurt, if that is the port number of the set. Ports 9000 to 9050 should not be necessary at the remote end.

what stun server should i use in the snom phone?

.

You can use the 3CX STUN server (stun.3cx.com) or any one of a number that are listed on the net, but you should have one of them datafilled in the SNOM phone or any remote extension behind a router.

 

[russellcrowe]

that should work then
either draytek or sonicwall is causing problem
either way both of these are well used products and if 3cx and snom do not work with them then what i am trying to do is no worth doing

need to stay with vpn but qos of call is no good when data also going down vpn

thanks
Russell