Firewall Check Fail (Audio issues) - OVH

[moss]

I have 5 Instance on OVH - All created through PBX Express at different times.
All Fail the firewall checker on Sip-ALG and Ports 10600-1099 - Full cone Test Fail - 1 instance is giving me audio issues, I believe the firewall is causing the problem.

I followed (https://www.3cx.com/community/threa...-failures-no-nat-public-ip.57186/#post-241493) and changed the iptables to accept through 10999: Heres the output
----------------------
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere sip.mcast.net
ACCEPT tcp -- anywhere anywhere multiport dports http,https,sip,sip-tls,5090 tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
ACCEPT udp -- anywhere anywhere multiport dports tftp,sip,5090,afs3-fileserver:10999

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
----------------------

The Phones are remote extensions using STUN. They are behind a remote firewall, but those are open too - would that be causing the Full Cone Nat failure?
PBX Delivers Audio is Checked
After a couple hours we have to restart services and audio works for a while on the 1 instance we are having audio issues with.

Thankful for PACT and YiannisH_3cx who have gotten me this far though the forums.

// Sidenote: In case someone else has an issue getting into their OVH servers that may find this - You have to boot them in rescue mode, vnc in using the supplied root user in the vnc console, mount the disk, alter the ssh key to your machine ssh key and then log-in using ssh [email protected] - their support can walk you through the process - just because it took me forever to figure that out.

 

[cobaltit]

3CX Firewall has nothing to do with remote extensions. It's a test between your 3CX instance and their hosted firewall test. If the changes you made to iptables aren't working it might be easier to backup, uninstall, reinstall, restore. You can do that manually or via PBX Express. This should result in the correct firewall/port ranges. OVH support can probably also help because while the ports are 3CX specific, opening them up on the OVH instance is not.

 

[eddv123]

If your firewall checker is stating those points (as @cobaltit) says this is a check of the hosted Firewall.

Now I don't use OVH but I know with the provider I use you can add a software Firewall to the instance to make these changes (and also setup VPN's etc) it maybe worth checking if you have one of these as you can at the least make the necessary changes to get your Firewall check green.

 

[pitrickzul]

I use OVH and have a security group that i apply for 3CX. Essentially if you ever created a PBX with the ExpressPBX website, it will auto create that security group for you. You need to log in the OpenStack user to be able to modify the parameters.

I never use the expesspbx tool anymore because i want a full debian version but i manually install my instances and just apply the pbxexpess security group that i originally had when i made my very first instance and everything works well.

 

[moss]

I'll try and re-install and see if that fixes it. All my OVH instances have this issue from PBXExpress.

I installed ufw and opened them (again) that way.

The security group has everything open - so it's not stopping it.

nmap tells me the ports are open - just fails the firewall test in 3cx.

I'll create and new instance it and re-store it manually - see if that fixes it.

 

[cobaltit]

So I don't use OVH and I'm not familiar with them but from what @pitrickzul says it looks like there might be an edge firewall separate from ufw/iptables that is causing your problem.

 

[pitrickzul]

I strongly advise to not configure your ingress rules in OVH to be open. Datacenters are constantly under attacks, the IPs are easy to find. You should have 2 egress rules for your outgoing TCP and UDP traffic, that's ok but for the rest, open ingress rules only for the ports you need and for 5060, i would add the IP(s) of your client's location for their deskphones so it's even more secure or else you will end up with over 400 blacklisted IPs after 3-4months hehehe

 

[pitrickzul]

Here's my Security Group config for OVH, like i said, it's really just the one 3CX created the first time i used the pbxexpress tool. I use it everytime i add an instance. As mentioned above, you could restrict 5060 to specific IPs.

I would recommend disabling ufw and giving it a shot.

 

[eddv123]

I use Virtual 1 and you can have a software firewall (PFSense) attached to the cloud system, I would also investigate this option for security reasons if you can.

 

[StefanW]

let me say, when using PBXexpress, we check if our firewall rules (called pbxexpress) are created,

1. if so, do not touch it (so your modifications remain)
2. If it does not exist, create it.

Problem on 1. is, that if the port range got increased by the PBX, we will not change the existing rule for given reasons and user needs to adjust it.

 

[moss]

Update: @StefanW PBX was created December of 18, which from my understanding was after the port increase so I believe it should have been set up correctly. When you say pbxexpress rules - are you talking about the iptables rules? Was I not looking in the correct place?

@pitrickzul - I checked the security group, it was different - there weren't as many rules as in yours, but they are all open. Checking it with nsmap - showed the ports as open.

When I create the instance myself and manually install 3CX - it works fine.

I copied the iptables over from the instance that passed the firewall checker, but it still didn't pass on ports 10600-10999. Running nsmap on the instance that isn't working, it shows those ports as open, but on the instance that passes firewall checker, those show up as closed.

After the rebuild and manual install, waiting for DNS to propagate through the night, and given a couple of days to make sure - it is working. Thanks for the help!

 

[moss]

I use Virtual 1 and you can have a software firewall (PFSense) attached to the cloud system, I would also investigate this option for security reasons if you can.

I checked - they didn't have any other firewalls running - only the software I/PBXExpress put on the machine.