Customer Firewall Rules

[rjones]

Hi,

I am setting up hosted 3CX and would appreciate any advice on the firewall ports required to be opened at the customers end. They also have a SBC capable phone on-site.

Looking at the docs - I am thinking the following:-

Source : Phone System IP Address
Destination : Customers SBC
Ports : tcp-443, tcp-5001, tcp-5090, udp-5090

Source : Customers LAN
Destination : Phone System IP Address
Ports : tcp-443, tcp-5001, udp-5090, tcp-5090

Also, do we need to open port 5060?

Thank you in advance

 

[Alphabetic]

Use the SBC, no port forwarding required.

on the PBX end see here

https://www.3cx.com/docs/manual/firewall-router-configuration/

 

[JohnS_3CX]

Hi,

I am setting up hosted 3CX and would appreciate any advice on the firewall ports required to be opened at the customers end. They also have a SBC capable phone on-site.

Looking at the docs - I am thinking the following:-

Source : Phone System IP Address
Destination : Customers SBC
Ports : tcp-443, tcp-5001, tcp-5090, udp-5090

Source : Customers LAN
Destination : Phone System IP Address
Ports : tcp-443, tcp-5001, udp-5090, tcp-5090

Also, do we need to open port 5060?

Thank you in advance

Hi,

If the PBX is hosted by 3CX, we take care of the firewall rules at the server end.

At the customer's end, do not perform any port forwards whatsoever. If you added any, please remove them.

This is because the server is the one listening for traffic at various ports, not the clients.

Will they be using the 3CX apps or will they be using hardware phones?

 

[rjones]

Hi,

If the PBX is hosted by 3CX, we take care of the firewall rules at the server end.

At the customer's end, do not perform any port forwards whatsoever. If you added any, please remove them.

This is because the server is the one listening for traffic at various ports, not the clients.

Will you they be using the 3CX apps or will they be using hardware phones?

Thank you for your reply and for your help. They will be using both Yealink handsets and the 3CX apps.

 

[JohnS_3CX]

Can you please tell me the models they are planning to use?

 

[rjones]

Use the SBC, no port forwarding required.

on the PBX end see here

https://www.3cx.com/docs/manual/firewall-router-configuration/

Great - thank you

 

[rjones]

Can you please tell me the models they are planning to use?

Handset / SBC - Yealink T54W
Other Handsets - Yealink T46S

 

[JohnS_3CX]

Excellent! Your T54W can act as the SBC both for itself and for the T46S phones.

Make sure to follow our guides and have the supported firmware installed, and the phones have been factory reset before assigning them in 3CX and you should be just fine.

Note: The T54W has to be up and running first before you configure the other phones that will use it as their SBC

T5 Series guide can be found here https://www.3cx.com/sip-phones/yealink-t5-series/
And T4 Series guide can be found here https://www.3cx.com/sip-phones/yealink-t4-series/


As for the apps, they don't need any special sauce, just install them and provision them and they should be good to go.

 

[rjones]

Excellent! Your T54W can act as the SBC both for itself and for the T46S phones.

Make sure to follow our guides and have the supported firmware installed, and the phones have been factory reset before assigning them in 3CX and you should be just fine.

Note: The T54W has to be up and running first before you configure the other phones that will use it as their SBC

T5 Series guide can be found here https://www.3cx.com/sip-phones/yealink-t5-series/
And T4 Series guide can be found here https://www.3cx.com/sip-phones/yealink-t4-series/


As for the apps, they don't need any special sauce, just install them and provision them and they should be good to go.

That's great - thank you for your time.

 

[JohnS_3CX]

You're welcome, let us know if you have any trouble during your deployment and we can help out

 

[rjones]

You're welcome, let us know if you have any trouble during your deployment and we can help out

I have just been on-site and I'm afraid the phone / SBC didn't provision and is being blocked by the firewall - any suggestions welcome.

I have also tested the phone away from the site and it works perfectly!

 

[bitn2]

I have just been on-site and I'm afraid the phone / SBC didn't provision and is being blocked by the firewall - any suggestions welcome.

I have also tested the phone away from the site and it works perfectly!

When its blocked by the firewall, you need to forward outgoing port 5090 and https.

 

[rjones]

When its blocked by the firewall, you need to forward outgoing port 5090 and https.

Great - thank you for you help. I assume the HTTPS is for provisioning?

Do I need any inbound ports going to the SBC?

 

[bitn2]

Great - thank you for you help.

Do I need any inbound ports going to the SBC?

No, nothing inbound.

 

[rjones]

No, nothing inbound.

Great - so the following is correct?

Source : LAN
Destination : Hosted Phone System
Ports : tcp-443, udp-5090, tcp-5090

 

[JohnS_3CX]

@bitn2 But if you see above, they are using Hosted by 3CX. They do not need to forward anything.

@rjones what version is the firmware on the T54W? If you did not install the correct version the PBX will block you.

 

[rjones]

No, nothing inbound.

@bitn2 But if you see above, they are using Hosted by 3CX. They do not need to forward anything.

@rjones what version is the firmware on the T54W? If you did not install the correct version the PBX will block you.

HI,

Thank you for your reply. I am not surprised it doesn't work to be honest, it's a school and have a very strict firewall.

Updated the firmware to 96.86.0.74 and it works perfectly away from the school site.

 

[bitn2]

@bitn2 But if you see above, they are using Hosted by 3CX. They do not need to forward anything.

@rjones what version is the firmware on the T54W? If you did not install the correct version the PBX will block you.

That doesn't matter if your local firewall block 5090.

 

[JohnS_3CX]

That doesn't matter if your local firewall block 5090.

If it is not provisioned then it means the phones does not have outbound internet access, to the known 443 TLS port of the PBX.

They should allow access via their rules rather than forwards.
Forwards = the IP phone's port 5090 and 443 are accessible from the internet, which is not what we want here.

1. So I'd say remove any unnecessary forwards done, and first confirm whether the Phone has internet access.

2. Then confirm the firmware is correct, because it is known that trying to provision a SBC phone without correct firmware will lead to the office public IP being blocked on the PBX blacklist. This is a number one reason for SBC phone failures.

@rjones confirm that the phone has firmware 96.86.0.74 from the guides I shared. Then check on the PBX blacklist that your WAN IP has not been blacklisted. Confirm that you followed the guide and actually logged in the 3CX webclient, then clicked admin, then added the phone as a router phone per the guide. We need to confirm this first before looking at the firewalls etc.

 

[JohnS_3CX]

Thank you for your reply. I am not surprised it doesn't work to be honest, it's a school and have a very strict firewall.

Updated the firmware to 96.86.0.74 and it works perfectly away from the school site.

Ok you are good then - but the firewall rules need to be relaxed for the phones.

They need access to NTP, TLS, TCP outbound and they probably aren't allowing this now.

You need to adjust the firewall ACL for this, and if you don't control the firewall then the responsible party needs to intervene to take care of this.