Countries to Allow for Geolocation Firewall

[HFH-Digerati]

Hello, client is using a firewall with Geolocation turned on to block undesireable traffic. Is there a list somewhere of countries to allow so the 3CX PBX can communicate properly to get updates, renew certs, etc.? I had an issue installing with a file the install was trying to download from France being blocked.

 

[Evolute IT]

Simply allow everything from and to *.3cx.net and *.3cx.com and you should be good to go.

 

[HFH-Digerati]

Unfortunately it isn't that easy. Geolocation blocks are applied to allowed domains/IPs too. I have an explicit any outbound policy in the firewall for the PBX's IP and if the IP address something the PBX is trying to get to is in a blocked country, the traffic is blocked.

 

[Evolute IT]

Unfortunately it isn't that easy. Geolocation blocks are applied to allowed domains/IPs too. I have an explicit any outbound policy in the firewall for the PBX's IP and if the IP address something the PBX is trying to get to is in a blocked country, the traffic is blocked.

This is the kind of setup that renders having 3CX useless. You will not be able to use the license, the apps, the updates, the WebMeeting and many more.

Why would outbound be blocked? Specially to a country like France... It's not Syria you know (no judgement, just an example)

 

[HFH-Digerati]

The geolocation is in the business's external firewall and protects the entire business, not just the PBX - workstations, servers, etc. Since the location is in the US and no one routinely uses French web content (nothing against France or any country - if there is no reason to allow traffic, it should be blocked so that attacks cannot from that country), whoever set up the firewall rightly blocked France, since for purposes of least privilege - whatever isn't required for legitimate business purposes should be blocked.

Since this is a legitimate business purpose, I was hoping for a country list so I could allow countries 3cx pulls content from and block others.

 

[cobaltit]

I don't understand why people have firewalls they don't know how to use. If the firewall is configurable to block, then it should also be configurable to log. The logs will tell you what 3CX is trying to hit and then you can unblock what you need to. 3CX has global infrastructure and uses CDNs so it can hit things all around the world potentially.

 

[HFH-Digerati]

Ha, thank you. I do actually know how to use the firewall. I would just rather have a list of countries to allow and prevent problems in the first place, rather than having to determine by brail what countries resources are in the PBX needs access to.

 

[cobaltit]

Well if you do then you should be all set and you would appear to be one of the few ones that do since the topic comes up repeatedly. 3CX provides the FQDNs it needs to reach, nothing more. In theory most resources should be regional but not all. But basically the rest of the exercise is up to the reader as the saying goes.