Firewall Test Failing - All ports confirmed as forwarding

[Alan Figgins]

Hi All,

I am having trouble getting a 3CX install to pass the firewall tests.

This is a snippet showing the fails:

+-+-+-+-+-+-+-+-+-+-+-+-+

• testing 3CX SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... not detected
  • testing port 55060... full cone test failed (How to resolve?)
  • starting service... done
• testing 3CX Tunneling Proxy... failed (How to resolve?)
  • stopping service... done
  • testing port 55090... full cone test failed (How to resolve?)
  • starting service... done
• testing 3CX Media Server... failed (How to resolve?)
  • stopping service... done
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9000... full cone test failed (How to resolve?)

All subsequent media server tests failed too

+-+-+-+-+-+-+-+-+-+-+-+-+

As you can see, we are having to use non standard ports due to the ISP blocking 5060 and 5090.

I have had this working with a 3CX setup at home, using those ports, and it is all fine, but here I am getting the above fails.

I have checked that the ports are forwarding correctly, by connecting from outside (internet) using telnet, and it works fine to connect to both 55060 and 55090. Just to be 100% sure, I also did a telnet test from within the LAN, and that works fine too.

Can anyone suggest a further test I can perform to narrow down what is happening, or where to look from here?

Thanks in advance,

Alan.

 

[Alan Figgins]

Hi Lee,

You could consider co-locating the 3CX server and the main router.

Would that still work with the 3CX clients sitting behind the Inside-Router?

I'm also a little reluctant to have the 3CX Server sitting out in the open with the Outside-Router, but I guess it would look innocuous enough.

A better solution might be to use the ISP supplied router in modem / bridge mode, then you can use whatever router you like in partnership with it without worrying about double NAT or breaking ISP T&Cs / support arrangements.

This article might be interesting for you to have a look at: https://www.howtogeek.com/255206/how-use-your-router-and-isps-modemrouter-combo-in-tandem/

https://www.howtogeek.com/255206/how-use-your-router-and-isps-modemrouter-combo-in-tandem/

I'll have a look at that - I am not sure how that would dovetail with the other business, but I will investigate.

As a recent convert to 3CX I started with an on premise server but after trying a cloud deployment I simply wouldn't go back as it so neatly sidesteps lots of issues and is inexpensive.

Anything you do to work around the double NAT and continue with the additional routing is, unfortunately, going to be a bit of a kludge...

Yes - I can't disagree

Thanks,

Alan.

 

[cobaltit]

Unfortunately, there is no practical way to get an ethernet connection from the 3CX Server to the Outside-Router. There is only one cable run, which is already running to the Inside-Router, else I would definitely go wired if I could.

Can you just run the ethernet cable that is going to the WAN of the inside router into a small 5 port switch and then plug the inside router WAN and the 3CX box in ? Or am I not understanding the setup?

 

[Alan Figgins]

Hi cobaltit,

Can you just run the ethernet cable that is going to the WAN of the inside router into a small 5 port switch and then plug the inside router WAN and the 3CX box in ? Or am I not understanding the setup?

Yes - we could do that, but as I said above, I'm also a little reluctant to have the 3CX Server sitting out in the open with the Outside-Router.

I will have to talk to my client, but currently that is where I am heading.

Thanks,

Alan.

 

[cobaltit]

What 'open' are you talking about? It's behind the outside router so there is still a NAT layer between it and the internet and wouldn't be any more open to the internet than you already tried to accomplish with the port forward you were trying to do. It would be slightly more open to the other company sharing your internet but that's about it.

 

[Alan Figgins]

Hi cobaltit,

What 'open' are you talking about? It's behind the outside router so there is still a NAT layer between it and the internet and wouldn't be any more open to the internet than you already tried to accomplish with the port forward you were trying to do. It would be slightly more open to the other company sharing your internet but that's about it.

I mean in a physical sense - it will be sitting out in the open in the shared space just inside the front door, rather than in a 'server room' (actually an unused office) in my client's space.

I'm not concerned about it in a network security sense.

Thanks,

Alan.

 

[cobaltit]

Ahh ok that makes more sense . Well good luck with whatever option you go with!