Double NAT configuration

[DjordjeV]

Hi all.
Ok, I have situation where my pbx is behind two routers. ISP's and Mikrotik. When i forward ports needed for 3cx apps (5001,5090 and RTP ports 9000-10999), my firewall checker fails in everything except on SIP alg wich is disabled, yet 3cx apps seem to work just fine, I can provision them outside LAN, i can see other extensions status and I can make calls. As I remember I have set DMZ on ISP router to Mikrotik router and firewall checker still fails. When i check needed ports via browser app to check if the ports are open on ISP router, it gives me green light. Anyone have OR had similar problem(IF it is a problem, since apps are working). Is it something about mikrotik router and can this problem affect call/sound quality on 3cx apps?
Thanks in advance.

 

[JohnS_3CX]

Hi @DjordjeV

If you have double NAT things can get tricky, it might work and then again it might stop working when you least expect it so I would not consider the current setup as reliable.

Depending on the provider, you may or may not be able to do anything about it - but here is what I would suggest:

- DMZ the PBX directly on the ISP modem
- Run the firewall checker to see if it passes
- If it passes just fine, start suspecting the Mikrotik config (likely the culprit)

Not sure how well you know the Mikrotik as a device, if you know some other router better then replace the current one with one you know and test again.

Your goal is now to figure out if the ISP or the router is the one causing the issue so you can decide what to do according to what you find along the way.

 

[leejor]

If the ISPs router is issuing your router a private IP, then, the question is, do you have any forwarding control, of the port on their router? If this is the case, And I've seen it with another provider, some ports, you wish to use could be "allocated" to other customers of theirs. They may be doing this, to provide service to the maximum number of customers, using a limited number of public IPV4 addresses.

 

[DjordjeV]

If the ISPs router is issuing your router a private IP, then, the question is, do you have any forwarding control, of the port on their router? If this is the case, And I've seen it with another provider, some ports, you wish to use could be "allocated" to other customers of theirs. They may be doing this, to provide service to the maximum number of customers, using a limited number of public IPV4 addresses.

It is dynamic public IP, and yes i can configure port forwarding on it.

 

[AWS2P]

They may be doing this, to provide service to the maximum number of customers, using a limited number of public IPV4 addresses.

I've been in that scenario with french ISP "FREE" who decided alone to change and share full range of ports for four customers and cherry on the cake changed Static public IP.
This was a huge problem for me as no one was informed even their support and I needed to find problem origin alone , finally I fix it by asking a full range as it was, but doing this changed once more public IPV4.
It was painfull and time consumming and of course doing this for free and help customers who didn't knew what was running under their eyes

 

[leejor]

It is dynamic public IP, and yes i can configure port forwarding on it.

If your router is being assigned a public IP, from your ISP, then what makes you think it is double NAT and not some other network issue?

 

[DjordjeV]

If your router is being assigned a public IP, from your ISP, then what makes you think it is double NAT and not some other network

If your router is being assigned a public IP, from your ISP, then what makes you think it is double NAT and not some other network issue?

My bad then I guess, ports are forwarded from ISP router to Mikrotik and from Mikrotik to PBX.