Firewall Checks with Failures - NO NAT - Public IP

[Sean Glasspool]

Hi All,

We have a number of VPS 3CX instances built on Debian in our cloud.

New one built today and firewall checks fail. Checked against an existing install and we cant see any difference in the FW rules in Linux ( I have edited to show the failed ports)

Any hints? Bear in mind there is no NAT or SBC involved.

Cheers

Sean

resolving 'stun-au.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX SIP Server... done
stopping service... done
detecting SIP ALG... not detected
testing port 5060... done
starting service... done
testing 3CX Tunneling Proxy... done
stopping service... done
testing port 5090... done
starting service... done
testing 3CX Media Server... failed (How to resolve?)
stopping service... done
testing ports [9000..10743]... failed (How to resolve?)
testing port 9501... full cone test failed (How to resolve?)
all the way down to --->>
testing port 10743... full cone test failed (How to resolve?)
starting service... done

 

[eddv123]

Hi Sean,

From your fragment it looks like only media is blocked.

These guides may help:
https://www.3cx.com/docs/troubleshooting-firewall-checker/
https://www.3cx.com/docs/firewall-checker/

Normally these sorts of issues (as you are probably aware) are caused by the wrong or incorrect configuration of NAT, public IP address change or SIP ALG.

 

[StefanW]

Full Cone Test Failed relates to the following statement.

You send from UDP Port 9000 and the server saw you from port 9000.
Now from an IP which is not know to your system (PBX or Firewall) we send another message to 9000. This message never arrived.

https://en.wikipedia.org/wiki/Network_address_translation
Full-cone NAT, also known as one-to-one NAT

• Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort.
• Any external host can send packets to iAddr:iPort by sending packets to eAddr:ePort.

You fail from the test of Server 2 shown in the image...

 

[Sean Glasspool]

Hi There,

Thanks for the replies. As stated, there is no NAT involved. This is a public facing 3CX instance.

Cheers

Sean

 

[eddv123]

So you are using a 3CX system in the public cloud without a firewall and public-ally accessible IP address - please advise.

Where I have seen 3CX in the past suggest this is OK with a Windows instance (and Windows firewall enabled) I would not recommend it.

A quick look on whether Debian has an equivalent bought up this - have a quick read:
https://unix.stackexchange.com/ques...an-come-without-a-firewall-enabled-by-default

Although if you have the 3CX ISO or PBX Express there maybe some differences to the standard OS perhaps.

 

[pact]

HI, we're seeing exactly the same.

Existing working systems now expanded to using port 9000 - 10999 are failing the Firewall test for ports >9501.

3CX possibly there is another Linux setting you didn't set when performing the SP5 upgrade?

 

[YiannisH_3CX]

Existing working systems now expanded to using port 9000 - 10999 are failing the Firewall test for ports >9501.

3CX possibly there is another Linux setting you didn't set when performing the SP5 upgrade?

Please note that for the increase in ports to take place you need to re-install the PBX. Otherwise the PBX should not check beyond port 9255. If the PBX is re - installed but the OS is not re-installed using the 3CX ISO then you need to adjust the ports in the Debian IP tables.
If you install the system using the new ISO available in the 3CX site the ports will be present in the IP tables.

 

[pact]

Please note that for the increase in ports to take place you need to re-install the PBX. Otherwise the PBX should not check beyond port 9255. If the PBX is re - installed but the OS is not re-installed using the 3CX ISO then you need to adjust the ports in the Debian IP tables.
If you install the system using the new ISO available in the 3CX site the ports will be present in the IP tables.

Ahh interesting.

This system was installed 30 minutes prior to SP5 being released, so it was installed using the older ISO but the system downloaded the SP5 version. (Literally, I got the first SP5 email 30minutes after this system was installed).

Are you able to detail what needs to be changed in order for it to be updated?

 

[YiannisH_3CX]

Is the firewall checker trying to check all the ports? From 9000 to 10743?

 

[pact]

Is the firewall checker trying to check all the ports? From 9000 to 10743?

Yes it is.

 

[Jerry Janzen]

I am having the same issue just ports 9501 and higher.

 

[YiannisH_3CX]

Depending on the installation firewall and IP table rules must be amended to accommodate for the new ports so the firewall check is successful.

 

[Jerry Janzen]

Thanks for the reply.
Modified the firewall to any/any and still have the same result.

I think it is something in SP5. All other 3CX installations work fine that are not upgraded.
Upgrade and fresh install yield the same result.

All ports are good except 9501 and up.

 

[YiannisH_3CX]

All ports are good except 9501 and up.

Are you running the PBX on a Debian OS? If so then you need to adjust the IP tables also to accommodate for the new ports

 

[Jerry Janzen]

Yes Debian 9 OS.
Would you be so kind as to point me to adjusting these IP Tables?
We are all very new to Linux.

 

[sandstorm]

I too am having this same issue. New Debian install.

 

[pact]

To update the iptables in debian do the following;

Login to your VPS.

Make a backup of your iptables-persistent rules file with the following command. (Always good practice with any config changes in Linux).

cp /etc/iptables/rules.v4 /etc/iptables/rules.v4.bak

then run

nano /etc/iptables/rules.v4

use the arrow keys to go to line with

-A INPUT -p udp -m multiport --dports 69,5060,5090,7000:9500 -j ACCEPT

Update this to

-A INPUT -p udp -m multiport --dports 69,5060,5090,7000:10999 -j ACCEPT

Then press 'Ctrl+X' to exit and nano will prompt you to save, press 'Y' to confirm and 'Enter' to save as the current file.

Then simply reboot your VPS and the iptables-persistent changes will be applied.

Note: To see what the current rules are, run

iptables -L

Note2: If you run the -L command you will see the line show afs3-fileserver instead of '7000' this is simply because linux attempts to use english where possible for port numbers (ie http for 80, https for 443 etc).

Note3: To restore your original file, simply run the 'cp' command in reverse.

cp /etc/iptables/rules.v4.bak /etc/iptables/rules.v4

*I have not performed this on a broken machine to get it working, this is simply an iptables guide so it should correct the issue but let me know if the issue persists once you've updated the iptables and re-run the firewall checker..

 

[YiannisH_3CX]

I'm having the same issue, Debian 9 OS, brand new OS, brand new PBX, already opened the firewall. No NAT, and the "how to resolve" does not mention it. "Full cone test failed"

I too am having this same issue. New Debian install.

Did you download the latest 3CX iso to install the PBX? If so the IP tables should have been already pre-configured to accommodate the new ports.

 

[Jerry Janzen]

Thanks you pact!

Your directions worked great.
Now a happy green check-mark next to Firewall on the dashboard.

 

[craisondigital]

I had exact same issue from latest Debian install and can confirm that Pacts instructions worked for me as well!