Connecting to 3CX via dyndns on external interface

[brunnenguk]

While external access through a dynamic DNS provider is something that 3CX do not support I've found a source which claims it is technically possible: http://www.buchatech.com/2009/07/setup-3cx-pbx/

I've had a go at setting this up and internal calls between softphones (3CX softphone running on a windows box and 3CX softphone running on android) As a test I created 2 extensions: 10 and 11, connections were established.

So far so good.

I then switched the android device from wifi to the cellular network (3, UK) and tried to call extension 11 (the phone is set up to use extension 10). The phone registered but I was unable to make the call. Upon further investigation I found that extension 10 was reporting as registered but idle.

When I was carrying out initial configuration the firewall test was completed successfully and I have the following ports forwarded to the 3CX box:

IP_Telephony TCP 5480 5480 192.168.1.160
IP_Telephony TCP 5482 5482 192.168.1.160
IP_Telephony TCP 5483 5483 192.168.1.160
IP_Telephony TCP 5485 5485 192.168.1.160
IP_Telephony UDP 5480 5480 192.168.1.160
IP_Telephony UDP 5482 5482 192.168.1.160
IP_Telephony UDP 5483 5483 192.168.1.160
IP_Telephony UDP 5485 5485 192.168.1.160
IP_Telephony TCP 3400 : 3499 3400 : 3499 192.168.1.160
IP_Telephony TCP 5060 : 5100 5060 : 5100 192.168.1.160
IP_Telephony TCP 9000 : 9015 9000 : 9015 192.168.1.160
IP_Telephony UDP 3400 : 3499 3400 : 3499 192.168.1.160
IP_Telephony UDP 5060 : 5100 5060 : 5100 192.168.1.160
IP_Telephony UDP 9000 : 9015 9000 : 9015 192.168.1.160

Static public IP address is set to dansnowden.is-a-geek.com (as suggested in the page I found) and it was also set to be the "Public IP to specify in Contact and SDP"

When I try to connect and dial I get the following in the 3CX log:

13:03:12.668

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=7a57d957a2560042 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:02:51.154

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=991f8007ae76ff0f cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:02:29.558

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=a17e5067ac502474 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:02:08.086

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=dc26dc11f4656e79 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:01:46.525

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=c7383000b3039e03 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:01:24.956

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=152547532c1a9b6d cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:01:03.453

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=5441b0787a230944 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:00:41.902

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=ba337353a7226e4e cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:00:20.425

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=d56fa86010038f59 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

13:00:13.189

[CM504001]: Ext.10: new contact is registered. Contact(s): [sip:[email protected]:16725/10,sip:[email protected]:22452/10]

12:59:37.411

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=6e0a1016e81a9011 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

12:59:15.808

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=9069b95a59547b4a cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

12:58:32.750

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=131ec164ba035a7b cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

12:58:11.266

[CM102001]: Authentication failed for SipReq: REGISTER 127.0.0.1:5060 tid=f9389636545f1872 cseq=REGISTER [email protected]:6060 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

When connected to internal wifi I got the following (When I made a call)

13:06:21.570

[CM503008]: Call(2): Call is terminated

13:06:14.095

[CM503007]: Call(2): Device joined: sip:[email protected]:40600;rinstance=b934596d9e8632e3

13:06:14.082

[CM503007]: Call(2): Device joined: sip:[email protected]:5060

13:06:14.069

[CM505001]: Ext.99: Device info: Device Identified: [Man: 3CX Ltd.;Mod: Voice Mail Menu;Rev: General] Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CX Voice Mail Menu] PBX contact: [sip:[email protected]:5060]

13:06:14.068

[CM503002]: Call(2): Alerting sip:[email protected]:40600;rinstance=b934596d9e8632e3

13:06:13.922

[CM503025]: Call(2): Calling Ext:Ext.99@[Dev:sip:[email protected]:40600;rinstance=b934596d9e8632e3]

13:06:13.861

[CM503005]: Call(2): Forwarding: Ext:Ext.99@[Dev:sip:[email protected]:40600;rinstance=b934596d9e8632e3]

13:06:13.841

[CM503003]: Call(2): Call to sip:[email protected]:5060 has failed; Cause: 486 Busy Here; from IP:192.168.1.247:64694

13:06:06.451

[CM505001]: Ext.11: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone 5.0.14439.0] PBX contact: [sip:[email protected]:5060]

13:06:06.285

[CM503025]: Call(2): Calling Ext:Ext.11@[Dev:sip:[email protected]:64694;rinstance=88d2b80b35e16414]

13:06:06.254

[CM503010]: Making route(s) to <sip:[email protected]>

13:06:06.229

[CM503001]: Call(2): Incoming call from Ext.10 to <sip:[email protected]>

13:05:34.591

[CM504002]: Ext.10: a contact is unregistered. Contact(s): [sip:[email protected]:16725/10,sip:[email protected]:22452/10]

13:05:18.274

[CM503003]: Call(1): Call to sip:[email protected]:5060 has failed; Cause: 487 Request Terminated; from IP:192.168.1.247:64694

The profile on the android device is et up to use dansnowden.is-a-geek.com as an external server, has the default STUN server of stun3.3cx.com.

Does anyone have any suggestions?

 

[brunnenguk]

Update - I'm starting to suspect the firewall, I think some ports that it needs are closed. It seems to be able to connect but cannot make calls.

Trying to connect remotely from 3CXphone on windows I get the following messages after I tried to make a call:

Sending STUN request
Phone is now connected
video stream will be received on 92.239.48.70:40004
Forbidden

On windows it works if I use the tunnel, but this is not a viable solution as my cellphone is android based and 3CX for Android does not support the tunnel.

 

[leejor]

Well, DynDns does work for remote devices connecting back to a non-static IP 3CX. I use it everyday. Now that's not to say that there are not some other issues that you are encountering when going through your mobile service provider rather than via WiFi. It looks like you have the proper ports open.

Not sure what the logs involving the device 10000, generally that sort of number will be a trunk (gateway?), not being able to register.


This one log shows Ext 10 as being registered.

[CM504001]: Ext.10: new contact is registered. Contact(s): [sip:[email protected]:16725/10,sip:[email protected]:22452/10]

In the second log, the call to extension 11 completes correctly, but because 11 is busy (or 3Cx sees it as busy) it then goes to voicemail as it probably should.

[CM503003]: Call(2): Call to sip:[email protected]:5060 has failed; Cause: 486 Busy Here; from IP:192.168.1.247:64694

Overall, from what you've posted, I don't see any issues other than the device 10000 not being able to register.

 

[brunnenguk]

Thanks for the reply.

I had wondered if my mobile provider was blocking SIP (network is 3). To attempt to rule this out I've shifted the virtual machine running 3CX (it's in a VM as it's for testing at the moment) to n isolated virtual network (VMware ESXi so virtual network devices have unique MAC addresses) connected by a router VM running the same software as my physical router and with the same firewall configuration.

Due to the limitations of being in an isolated network (only has the 3CX and router VMs) I've had to dial extension 11 while no softphone is logged in. This appears to work ok for testing as when attempting to call it from extension 10 via 3CX tunnel it simply "rang out". If you think this will introduce additional problems I can provision a second VM that I can run a softphone on (unless I can run 3CX phone on the same VM as the server?)

You mention that device 10000 could mean that a trunk can't register. Can you please elaborate on this? (I'm aftraid I'm new to this technology and am still trying to get up to speed)

 

[RichardCrabb1]

Hello,
From my own experience I am pretty sure that Three block SIP. I have an Iphone, and I need to use a VPN tunnel to connect to my router in the office. Once connected I can use the SIP phone application.

I cannot see anything in the log from the Android phone. As leejor says, 10000 is a gateway on port 6060.

Does the Android have a VPN capability? If so, use that.

I hope that helps
RIchard Crabb

 

[brunnenguk]

Configured 6060 and all other ports to forward to the 3CX box (as this is a testing machine on a second LAN so everything is behind the main firewall anyway, once I get it working I can sort out which ports to close off) and I'm getting a different error

19:29:35.850

Requests rate from IP 192.168.1.249 is too high! Blacklisted for 112 seconds

19:29:35.849

[CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:



INVITE sip:[email protected]:5060 SIP/2.0



Via: SIP/2.0/UDP 192.168.1.249:57883;branch=z9hG4bK-d8754z-2a055a314c597601-1---d8754z-;rport=57883



Max-Forwards: 70



Contact: <sip:[email protected]:57883;rinstance=efc323b4bc10d859>



To: <sip:[email protected]:5060>



From: "Martin"<sip:[email protected]:5060>;tag=930ffa1b



Call-ID: YWU2M2E1MzBjMDE5MzdlMWNhNzZlNzEyMDFiYmRjNmY.



CSeq: 1 INVITE



Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE



Supported: replaces



User-Agent: 3CXPhone 5.0.14439.0



Content-Length: 0





19:29:35.849

[CM302001]: Authorization system can not identify source of: SipReq: INVITE [email protected]:5060 tid=2a055a314c597601 cseq=INVITE [email protected]:57883 / 1 from(wire)

19:29:30.322

[CM302001]: Authorization system can not identify source of: SipReq: SUBSCRIBE [email protected]:5060 tid=ef7dfb17e207857a cseq=SUBSCRIBE [email protected]:57883 / 1 from(wire)

19:29:30.148

[CM504001]: Ext.11: new contact is registered. Contact(s): [sip:[email protected]:57882;rinstance=d93fddc7310ac2bc/11,sip:[email protected]:57883;rinstance=efc323b4bc10d859/11,sip:[email protected]:50253;rinstance=dda6d10cc7062c91/11]

Problem now seems to be source identification. I've found some info on the 3cx website http://www.3cx.com/blog/docs/source-identification-issues/ but I'm not sure if this refers to an old version as I can't find Lines in the management console

 

[RichardCrabb1]

I forgot to mention before that I have seen NAT occurring on the three network.

Richard Crabb

 

[RichardCrabb1]

Hi,
I should have read your logs properly. The port number kind of indicates that NAT is going on. Impossible to fix without this NAT awareness, plus the fact that Three are doing what they can to prevent it from working. A tunnel works perfectly on my Iphone.

Richard Crabb

 

[brunnenguk]

As I have only one public IP address I've had to use NAT. Between NAT and the 3 working to prevent the use of SIP (yet another reason I should switch to a different provider) it looks like I have only 2 options:

1) use the 3CX tunnel which definitely works
2) Use VPN

Is there much support for the tunnel in third party applications or is this something that's 3CX specific?