DNS Helper

[beurle]

I am trying to simplify provisioning for remote deskphones. The DNS helper feature seems dead with the recommendation to continue with split DNS.

The system is very simple with the phone system behind a internet connected router and there are port forwards in the router to the 3CX box. There are a dozen phones internally connected.

Internally the FQDN resolves back to 3CX due to NAT loopbacks. Under phone provisioning I tried to select the FQDN interface but this did not work. Port 5000 is not forwarded on NAT (insecure?), is this the only reason this does not work?

 

[cobaltit]

Seems pretty simple to test. Port forward 5000.

 

[beurle]

Leaving port 5000 open to the internet is not a good idea?

Under settings | parameters do a seach on _local and there are a number of settings that link to port 5000.

I can spend more time on this but its not discussed in docs , so just wanting to know if I am wasting time.

 

[cobaltit]

Not a good idea because....?

But no one said you had to leave it open. You asked if it wasn't working because port 5000 wasn't open. Open, test, close and you have your answer. If it works, you can decide if you want to leave it open or go through the trouble of setting up split DNS. Or move it to hosted and then not have to worry about anything at all.

 

[NickD_3CX]

Leaving port 5000 open to the internet is not a good idea?

Under settings | parameters do a seach on _local and there are a number of settings that link to port 5000.

I can spend more time on this but its not discussed in docs , so just wanting to know if I am wasting time.

Apart from it being a bad idea in my view, I don't think it will work either. The request from the phone will go to the Firewall, that will redirect based on the NAT, but I suspect that the Firewall in doing this will translate the Source IP to be it's Public IP.
Nginx will reject/ignore any requests made to the non-HTTPS port (default 5000) coming from an IP that is not in RFC1918 (aka, local IP address).
If you really want to do this, you would also have to ensure that the Source IP is that Local IP of the device that made the request (NOT the local IP of the Firewall).
Then this might work, but on the other hand, if you have many devices internally doing this, to you really want to burden your Firewall with all this extra traffic?

Also, don't change the parameters, that can royally mess up a lot of things and then you'll be wondering why some things aren't working.

All in all, I find Split DNS and EXCELLENT idea and very efficient, but I think it should be done properly.

 

[beurle]

In a loopback scenario I believe the requests will appear to come from internal NAT interface rather than the public address.

Thanks for your advise.

 

[Saqqara]

See you you can add a dns entry on the fiirewall that points the fqdn to the internal 3cx IP address

We use this on the draytek routers - works all the time https://www.draytek.co.uk/support/guides/kb-lan-dns