Firewall Checker Fails when Ports limited to 3cx.com/co.uk

[ieuan.price]

Hi
I'm in the process of setting up an On-Premise 3cx installation in a school, on a windows server. We have our internet connection through the local authority and so connected via the PBSA (Public Sector Broadband Aggregation) and am forced to use out County Comms teams to configure the firewall. We have tried a number of things, and they have openned all of the ports in the firewall checker and the system works perfectly. However they are worried about the security of having all of these ports openned to anything and want to limit this - we suggested by limiting them to connection 3cx.com and 3cx.co.uk, however when we do this all ports fail on the firewall checker.

Can anyone tell me where the ports neet to connect to in order for the firewall checker to pass and the system to function?

Thanks

 

[ChrisC_3CX]

The two main destinations the 3CX PBX must absolutely be able to contact without restrictions would be the download servers to be able to download updates "downloads-global.3cx.com, downloads-eu.3cx.com, downloads.3cx.com" and the 3CX activation servers so that the License can activate "activation.3cx.com".

You can try adding the FQDNs such as the ones used for our stun servers (found in Settings >> Network) but do bear in mind that IPs that are not included in those FQDNs are also used during the firewall check so the FQDNs alone would not be enough. Plus, these IPs may change at any time without warning so we do not have a list of all destinations that would cover all required traffic.

I guess one could potentially monitor the traffic on the firewall to collect information about all the traffic their 3CX PBX requires, however this would of course require some effort and may be tedious to maintain and manage especially due to the IP changes.

To ensure 3CX functionality stays unaffected, we would not recommend restricting outbound traffic to this level.

 

[ieuan.price]

Thanks for this - we’ve run the checker with all ports open to 3CX.com addresses but it fails - but works perfectly open to all addresses, however the security team don’t like how open this is so say it needs to be limited to a number of addresses - any idea of other destinations?

 

[SteveITS]

however the security team don’t like how open this is so say it needs to be limited to a number of addresses

3CX will function with restricted ports as long as the ports you need are open for the devices that need them. In other words you can restrict SIP trunk ports to your SIP provider's IP and leave the mobile client and media ports more open so people can connect outside the office. The firewall test does not need to be green for 3CX to function. Though, it will be the first question asked in case of any problems...does it work with the ports open?

 

[ieuan.price]

3CX will function with restricted ports as long as the ports you need are open for the devices that need them. In other words you can restrict SIP trunk ports to your SIP provider's IP and leave the mobile client and media ports more open so people can connect outside the office. The firewall test does not need to be green for 3CX to function. Though, it will be the first question asked in case of any problems...does it work with the ports open?

Thanks for this - yes the system does seem to be able to make and recieve calls and havent found anything not working yet so maybe I'll stop worrying about making the firewall checker go green

Thank you for you help