De-register 3cx app when it leaves the LAN

[George Ts]

Hello,
I am trying to apply something very simple:
When a 3cx app (Android) leaves the LAN, it gets de-registered, so that its forwarding rules are applied.
Can we achieve that?

Side info, my test results:
- Enabling the "Disallow usage of extension outside the LAN" option does have effect on 3cx apps, as they use the tunnel protocol and not SIP or STUN
- Disabling the "Use 3CX Tunnel for remote connections (3cx apps only)" does not seem to work either. The device gets normally provisioned, registered over mobile data and displays "ready for calls". It can actually make and receive calls.
- "Block Remote Tunnel Connections (3CX App connections with Tunnel enabled & SBC will be blocked)" does not work either. The 3cx app extension gets normally provisioned and registered. However, when it tries to place a call, it receives an "Invalid Password" message and the call is not placed. When it receives a call, it rings normally, and when it tries to answer the call is logged as a missed call. The user calling the 3cx app keeps listening to a ringing tone, until they cancel the call.

Thank you in advance,
George

 

[Saqqara]

Can not be automatically , change the status of the phone within 3cx app and untick ‘enable push notifications’
Each status allows you to disable ‘push notifications’

If you have no requirements for external devices to connect remove port forwarding of the tunnel port 5090. This will affect all 3cx mobile apps and sbc servers

 

[George Ts]

Thank you @Saqqara
This was useful for sure, but it does not quite help reproduce what I am trying to achieve.
Indeed, by disabling the " enable push notifications" option, the extension is considered as unregistered and its forwading rules are applied, regardless if it is in the same LAN as the PBX or outside it.
What I need is that the PBX sees the extension/3cx app as registered within the LAN, and as soon as the 3cx app user leaves the LAN (WiFi) or uses mobile data, the PBX sees the extension as unregistered.
Is that possible?

 

[AWS2P]

Nope, As Saqqara said above, need to be done manually on App changing status to no push

If phone were with no sim card then of course when they lose WIFI they will be in unregistred status alone

 

[George Ts]

Sorry, but I am not sure I got it 100%.
What is the actual point of the "Enable Push Notifications" parameter?
Ever since I enabled it on an extension under the Phone Provisioning tab, it can only make calls, but it cannot receive, and its forwarding rules are applied. Did I get this right?

 

[Saqqara]

Enable push notifications allows the 3cx to wake up the mobile application to receive calls

If you disable this function, 3cx application will not receive any calls - as you have found out you can still make calls.

Have a read of https://www.3cx.com/docs/android-app-faq/ , on changing status and push notifications

 

[cobaltit]

So in order to do what you want you would need to either:

-Disable the tunnel port in the firewall in front of 3CX and then restrict the SIP ports in the 3CX firewall to only your SIP trunk provider. Then the app won't be able to register remotely and thus be offline.
- Disable the tunnel in the 3CX app as you tried and then restrict the SIP ports so the app can't register over SIP. Don't forget to reprovision the app.

 

[leejor]

The issue is going to be, that without any action by the user , immediate "de-registration" is not going to happen. Even with a wired desk phone, 3CX will consider it registered until the timeout is reached, when it expects the set to re-register, and it does not, or a call attempt to the set is made. That is simply the way SIP works, With a mobile app, you also throw in push notifications, where 3CX believes the phone is "out there", until it has confirmed that it is not.

 

[George Ts]

Thank you everyone for your responses.
@leejor at this point, this is my last concern. In another topic I asked what is the keep alive (re-registration?) interval used by push notifications, but I did not get a response. I can live with the fact that 3cx considers the extension-app as reachable for a few minutes after it leaves the office.
@cobaltit if you don't mind, i could use some further clarifications for your point #2. By saying "disable the tunnel in the 3cx app" you mean disabling the "Use 3CX Tunnel for remote connection" parameter? But disabling this allowed the app to both make and receive calls, which raises one more question: What is this parameter's point? Sorry for the numerous questions.

George

 

[cobaltit]

The app can use either the tunnel or a direct SIP connection. Disabling the tunnel forces it to use direct SIP. But if you don't block direct SIP at the firewall, then it will still connect.

For push notifications, if you want more information, then Google it Seriously though, push is a Android/Google or Apple thing. They control it, not 3CX.

 

[leejor]

The app can use either the tunnel or a direct SIP connection. Disabling the tunnel forces it to use direct SIP. But if you don't block direct SIP at the firewall, then it will still connect.

...and if the extension App is prevented from using the tunnel, it can then be blocked from registering remotely, in the extension options

 

[JohnS_3CX]

Just a note here, the mobile app will only work via tunnel. They can no longer use direct connections.

The tunnel is established for internal calls too.

 

[George Ts]

The verdict is:

Block incoming tunnel connections from any source IP other than the office's WiFi network on the Firewall sitting in front of the PBX.The drawback of this solution is that the PBX will not become instantly aware that the extension left the office, but it will wait until the next keep alive until it discovers that the app is not reachable.
Any setting on the PBX will not suffice.

Please correct me if I got this wrong.

Thank you,
George

 

[cobaltit]

Just a note here, the mobile app will only work via tunnel. They can no longer use direct connections.

The tunnel is established for internal calls too.

Oh? I mean I know it used to default to the tunnel, and then for a while there you guys were pushing direct SIP by default because it was 'better' although I think ultimately that was because Apple was being a PITA with requiring a separate app download for the 3CX tunnel. I always preferred the tunnel anyways.

Does this mean the desktop app is going that route as well?

 

[JohnS_3CX]

@cobaltit The Windows app will still obey the extension settings, you can enable/disable the tunnel as needed and it will activate when outside the the LAN.

@George Ts yes, if you block the tunnel for "any" outside your LAN, it should stop the apps from working when they leave your network. Be aware that the tunnel block prevents mobile apps and SBCs from connecting, as well as windows clients that have been set up to use the tunnel when they run externally. In addition, if you also block Direct SIP connections it will also prevent Windows clients from connecting remotely entirely, as well as block any STUN phones or pretty much anyone who knows the credentials of an extensions and tries to use them to register on your PBX.

 

[George Ts]

Hi @JohnS_3CX
Yes, the limitations above were clear. In other words, there is no way to implement it for specific extensions. It's a pitty however, if 3cx apps worked with SIP, the parameter "Disallow usage of extension outside the LAN" would do the trick for each or a set of extensions.
Thanks for the feedback!