Firewall check ports remail closed for almost all port - on premise debian 9

[ECOM GROUP (Mauritius)]

Hello, I am testing 3cx pro on debian 9 installed on a mini pc. Firewall check for port 9000 - 10998 appeared red and showing port mapping is xxx .

3CX sip server failed. is there anyone can help?

I am using a Fiber internet connection , huawer router HG8245H , i tried to open port and still same. i have disabled SIP ALG and this is ok, but other port issue remain.

Thanks

 

[ECOM GROUP (Mauritius)]

If they don't block any port, and you forward them correctly, then you should not have any issues I would expect.. so I'm fairly confident that this is a firewall issue.

I think what was being questioned here was whether the ISP router allows full cone NAT port forwarding. Maybe you just need to experiment a bit more with it and avoid 5060 using a fresh install. The do not change the 5060 on the ISP modem since they will reprovision it automatically again.

ISP Said nothing is being blocked. i am using full cone nat which months ago it was Restricted Nat by default. Still port issue , sip server failed, and windows softphone 3cx does not register via fqdn , only via local ip.

 

[JohnS_3CX]

Is this a VM on the mini PC or are you using it as physical machine connected directly to the Orange modem?

 

[ECOM GROUP (Mauritius)]

If they don't block any port, and you forward them correctly, then you should not have any issues I would expect.. so I'm fairly confident that this is a firewall issue.

I think what was being questioned here was whether the ISP router allows full cone NAT port forwarding. Maybe you just need to experiment a bit more with it and avoid 5060 using a fresh install. The do not change the 5060 on the ISP modem since they will reprovision it automatically again.

I have also disabled firewall on the router. nothing seem to be improved. How will i know if communication is being block from 3cx and my router? is there anything i can try to ping?

 

[ECOM GROUP (Mauritius)]

Is this a VM on the mini PC or are you using it as physical machine connected directly to the Orange modem?

Its a physical Machine connected directly to Orange Huawei GPON Router. No Dual OS, just debian 9 3cx iso

i have another PC i have tried to install a windows version.. and result same port issue

 

[ECOM GROUP (Mauritius)]

Is this a VM on the mini PC or are you using it as physical machine connected directly to the Orange modem?

i had 3CX sbc before which i was trying to use for another hosted pbx on windows 10, but i think is is also causing issue , i am trying to uninstall it, but it never get uninstall, can you help to uninstall it to check if the sbc was causing an issue for the port?

 

[JohnS_3CX]

Ok then the networking equipment is remapping the ports. You mentioned the firmware was updated on it so it is no longer the "same" modem as it was before. The SBC does not remap ports and is not part of the firewall checker at all.

Take the mini pc to another internet connection if you want, and open the ports there. If it works ok then you have isolated the Orange connection to be the probable cause.

 

[ECOM GROUP (Mauritius)]

Ok then the networking equipment is remapping the ports. You mentioned the firmware was updated on it so it is no longer the "same" modem as it was before. The SBC does not remap ports and is not part of the firewall checker at all.

Take the mini pc to another internet connection if you want, and open the ports there. If it works ok then you have isolated the Orange connection to be the probable cause.

In my country there is only one type of internet router provider which is reliable. and another 1 use LTE simcard internet which is worst. i am trying something and will send updates.

 

[JohnS_3CX]

I'm wondering if the provider uses CGN or LSN natting within their network.

If this is the case, then port forwards on the modem will make no difference, as their is another NAT in the ISP core network. This is used sometimes to save IPv4 addresses, and many customers may be sharing the same address so they remap the ports on the public IP before it even reaches your modem. This is more prevalent in LTE connections but maybe the provider can tell you more information.