Firewall Test Failing - All ports confirmed as forwarding

[Alan Figgins]

Hi All,

I am having trouble getting a 3CX install to pass the firewall tests.

This is a snippet showing the fails:

+-+-+-+-+-+-+-+-+-+-+-+-+

• testing 3CX SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... not detected
  • testing port 55060... full cone test failed (How to resolve?)
  • starting service... done
• testing 3CX Tunneling Proxy... failed (How to resolve?)
  • stopping service... done
  • testing port 55090... full cone test failed (How to resolve?)
  • starting service... done
• testing 3CX Media Server... failed (How to resolve?)
  • stopping service... done
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9000... full cone test failed (How to resolve?)

All subsequent media server tests failed too

+-+-+-+-+-+-+-+-+-+-+-+-+

As you can see, we are having to use non standard ports due to the ISP blocking 5060 and 5090.

I have had this working with a 3CX setup at home, using those ports, and it is all fine, but here I am getting the above fails.

I have checked that the ports are forwarding correctly, by connecting from outside (internet) using telnet, and it works fine to connect to both 55060 and 55090. Just to be 100% sure, I also did a telnet test from within the LAN, and that works fine too.

Can anyone suggest a further test I can perform to narrow down what is happening, or where to look from here?

Thanks in advance,

Alan.

 

[cobaltit]

Are you having an actual problem? I mean the firewall test is there for a reason but if you are certain the ports are forwarded correctly just fire up your SIP trunk and test. Could be that the firewall test doesn't like those high ports. Could also just try something like 6060 for SIP (not sure why you'd change the tunnel port as that is 3CX proprietary and not likely to be blocked)

 

[cobaltit]

Just realized the RTP ports aren't working either. Double NAT perhaps?

 

[Alan Figgins]

Hi Cobaltit,

Good point about just testing - I will do that when I get back onsite, and see if it just works.

I had not considered the possibility of a double NAT - I just tested from the LAN (same subnet where the 3CX server is), and from outside, via telnet, but I do not manage the router, so it would be possible - I just requested the ports be forwarded and tested to make sure it was done correctly.

If there is a double NAT, will that definitely cause a problem, and if so, how can I solve that?

Thanks,

Alan.

 

[eddv123]

Not having control of the router/firewall in front is never a good thing in my opinion. If you are in regular touch with whomever provider it is then less of an issue I guess.

Who is your ISP/ITSP router brand provided and network setup ? Some providers send pre-configured routers out also - are you aware if this is the case and the configuration also ?

FYI double NAT will be when you have a device in front of your router/firewall also NAT'ing however if you are not managing the network you will need to ask whomever does to provide the answer.

 

[Alan Figgins]

Hi,

I have confirmed that the setup is double NATed - there is a router on the outside (call that RouterOutside), then another router inside of that (call that RouterInside), within which is the LAN.

The location has two separate businesses, one of which has no incoming connections (not my client), and my client has complete control over both routers.

The other business has their own router also connected to RouterOutside.

We can have any ports open and forwarding from Internet -> RouterOutside -> RouterInside -> 3CXServer that we want, and currently they are setup.

Does that indicate anything I should be looking at / for?

Thanks again - I very much appreciate your help.

Alan.

 

[leejor]

You might want to check and see if the ISP allows more than one public IP per customer. If they do, then the first router may have an option to allow one of the WAN ports to be set to bridge mode. That should allow it to pick up a different public IP, which would then be used by the second businesses router. That would eliminate the need for 3CX to have to pass through two routers.

 

[Alan Figgins]

Hi leejor,

You might want to check and see if the ISP allows more than one public IP per customer. If they do, then the first router may have an option to allow one of the WAN ports to be set to bridge mode. That should allow it to pick up a different public IP, which would then be used by the second businesses router. That would eliminate the need for 3CX to have to pass through two routers.

Good idea - I will check that in the morning.

Thanks,

Alan.

 

[eddv123]

Just to elaborate further ( for the network administrator) the recommended NAT setup for 3CX would be Full feature NAT (sometimes called 1-1 NAT) where you configure and link a public IP address to a private one (Public to Private of 3CX basically).

Obviously to do this you would need a block of IP addresses on the WAN (one of which you would allocate specifically for 3CX).

I have not ever setup 3CX with double NAT however, but have with 2 routers - in which the first router was bridged, no-NAT'd and had DHCP, Firewall etc all turned off.

 

[Alan Figgins]

Hi,

No go on the additional public IP address.

Does that mean that I have to find a way to eliminate the double NAT to have any hope of getting this to work?

Thanks,

Alan.

 

[Lee Cramman]

If this is a test-bed / new deployment on premises and you can't gain control over the router(s) you could always consider a cloud deployment with an SBC instead.

 

[leejor]

The location has two separate businesses, one of which has no incoming connections (not my client), and my client has complete control over both routers.

Does the router have the ability to create VLANs, to separate traffic? Unless it is a router/modem supplied by the ISP, you might consider investing in a router that has that ability. Even if the router does have a modem (which you are forced to use), many times a bridge can be created, to allow you the use of your own router, getting a public IP, from one of the LAN ports. The customer using 3CX could be configured, then the second customer (only using outgoing, yet you don't want then to see traffic on the other network), could be configured on the VLAN.

 

[Alan Figgins]

Hi,

@Lee Cramman:

This is a 'test' deployment on premises to see if we can get it working. The existing phone system is still in place, and we would only be using this on a test basis for a few months so that the client can get used to it, make sure it does what they want, works well (call quality etc), and is configured as they require. We would prefer not to go with a cloud option if we can avoid it. We did look at the Amazon S3 option, and that is a second choice we could still go with, if I can't get this to work with their setup.

@leejor,:

The external router is supplied by the ISP, and we are not supposed to change that (although my view is that it is up to us - presumably it just means that the ISP won't support us if we have any technical queries). It does have any VLAN options that I can see - its a very basic unit.

I thought of another option I am setting up now, which is to setup a WiFi connection from the 3CX Server to the external (ISP) router. That router has, up to now, had WiFi turned off (each of the two businesses have their own WiFi AP running on their own 'internal' routers).

I will see how that goes. My concern is capacity, in terms of how many calls it could handle simultaneously. The total extensions is only anticipated to be around ten, with a maximum of, say, four or five simultaneous calls at any one time, but we'll have to test I guess.


Thanks,

Alan.

 

[cobaltit]

So I'm really confused by your explanation because I don't understand why there should be double NAT although your symptoms indicated that might be it. Typically when an ISP provides equipment that equipment can either function as a router and route your public IP block to you (if you get a static IP or static block) and then you assign a public IP on your edge device, can be put into bridge mode so you can have a DHCP public IP assigned to your edge device, or it can provide firewall/NAT if it's a SMB type circuit. So unless you fall in the last category there shouldn't be double NAT. Now if the current ISP is using an IAD and providing dial tone to your current PBX then that could be messing with any voice traffic. So please confirm that you are currently setup like this:

public internet ----> router outside ----> RFC1918 space ----> router inside ---> 3CX instance

If that truly is your configuration then you would want to see if your ISP can give you a static public IP. If they are unable to do that when you could potentially put 3CX in between the routers and a SBC inside the network. Not what it was designed for but it should work.

There's also a chance that you already have public IPs and just aren't configured to use them. Some providers will configure their equipment with a single interface that is DHCP enabled. If you DHCP on that segment you'll get a RFC1918 IP address and the router will do firewall/NAT for you. But if you statically assign your public IP address it will just function as a router with no NAT. It's often referred to as multinetting. I've seen instances where the inside router/firewall was originally configured with a public IP and then it was reset or replaced and the configuration wasn't documented so now the WAN interface is on DHCP. Internet just works so no one is the wiser until you get something that doesn't play nice with double NAT.

I will see how that goes. My concern is capacity, in terms of how many calls it could handle simultaneously. The total extensions is only anticipated to be around ten, with a maximum of, say, four or five simultaneous calls at any one time, but we'll have to test I guess.

Is the 'it' the wireless connection? Shouldn't be a problem from a technical standpoint I think resolving the network configuration is the better way to go.

 

[Alan Figgins]

Hi,

So I'm really confused by your explanation because I don't understand why there should be double NAT although your symptoms indicated that might be it. Typically when an ISP provides equipment that equipment can either function as a router and route your public IP block to you (if you get a static IP or static block) and then you assign a public IP on your edge device, can be put into bridge mode so you can have a DHCP public IP assigned to your edge device, or it can provide firewall/NAT if it's a SMB type circuit. So unless you fall in the last category there shouldn't be double NAT. Now if the current ISP is using an IAD and providing dial tone to your current PBX then that could be messing with any voice traffic. So please confirm that you are currently setup like this:

public internet ----> router outside ----> RFC1918 space ----> router inside ---> 3CX instance

I am not familiar with the term 'RFC1918 space' but yes - that is about right.

The only thing missing is that there are two 'inside routers' - one belonging to my client, the other belonging to the other (unrelated) business that is in the same office space.

The 'Router Outside' has the single static public IP on its WAN-side and a private subnet (192.168.1.0/24) on its LAN-side, connecting to the two 'Inside Routers'.

My client then has its (inside) router with WAN-side being 192.168.1.4, and its LAN-side being 10.0.0.0/24, to which the 3CX Server is has been attached.

If that truly is your configuration then you would want to see if your ISP can give you a static public IP. If they are unable to do that when you could potentially put 3CX in between the routers and a SBC inside the network. Not what it was designed for but it should work.

We have a static public IP - it is 'shared' between the two businesses, but the other business has no incoming connections, so we can forward any ports we like to my client's inside router (which is what we have done).

There's also a chance that you already have public IPs and just aren't configured to use them. Some providers will configure their equipment with a single interface that is DHCP enabled. If you DHCP on that segment you'll get a RFC1918 IP address and the router will do firewall/NAT for you. But if you statically assign your public IP address it will just function as a router with no NAT. It's often referred to as multinetting. I've seen instances where the inside router/firewall was originally configured with a public IP and then it was reset or replaced and the configuration wasn't documented so now the WAN interface is on DHCP. Internet just works so no one is the wiser until you get something that doesn't play nice with double NAT.

You lost me there

The LAN between the Outside-Router and the two Insider-Routers is a 192.168.1.0/24 subnet with all three devices having fixed IPs (192.168.1.254 for the Outside-Router's LAN-side, and 192.168.1.3 and 192.168.1.4 for the two Inside-Routers' WAN-sides.

Is the 'it' the wireless connection? Shouldn't be a problem from a technical standpoint I think resolving the network configuration is the better way to go.

Yes - a wireless connection. If the WiFi capacity is good enough, then it solves the problem entirely.


Thanks,

Alan.

 

[cobaltit]

So RFC1918 is the private subnets used for internal networks aka your 192.168.1.x network. Any reason you are thinking of going wireless instead of just patching your 3CX instance into the switch between the routers and giving it something like 192.168.1.5? Then have 2 NICs in your 3CX box with one plugged into the switch between the outside router and inside routers and then the other interface behind your customer's router (with no gateway).

 

[Lee Cramman]

If your internet connection is provided by a third party (i.e. if you're in a managed office space) and you have absolutely no control over the gateway then this isn't the only problem you are likely to run into... Without implementing some form of QoS (for which you need control over the router) then there is no guarantee that your voice traffic will be allocated sufficient priority / bandwidth.

Presumably this setup is to enable you to share the same internet connection while separating the 2 LANs. Unfortunately, this is quite a clunky way of achieving that. If the 2 businesses are comfortable sharing one LAN then the two secondary routers could be changed to access points so that all routing was handled by the main router.

In my opinion you should only ever use WiFi when you can't use wired. It's just not terribly robust.

I think a cloud deployment is perfect for testing / trying out as you can get a year for free from either 3CX or Google and deployment using PBX Express is very easy.

 

[Alan Figgins]

Hi cobaltit,

So RFC1918 is the private subnets used for internal networks aka your 192.168.1.x network. Any reason you are thinking of going wireless instead of just patching your 3CX instance into the switch between the routers and giving it something like 192.168.1.5? Then have 2 NICs in your 3CX box with one plugged into the switch between the outside router and inside routers and then the other interface behind your customer's router (with no gateway).

Unfortunately, there is no practical way to get an ethernet connection from the 3CX Server to the Outside-Router. There is only one cable run, which is already running to the Inside-Router, else I would definitely go wired if I could.

Alan.

 

[Alan Figgins]

Hi Lee,

If your internet connection is provided by a third party (i.e. if you're in a managed office space) and you have absolutely no control over the gateway then this isn't the only problem you are likely to run into... Without implementing some form of QoS (for which you need control over the router) then there is no guarantee that your voice traffic will be allocated sufficient priority / bandwidth.

Presumably this setup is to enable you to share the same internet connection while separating the 2 LANs. Unfortunately, this is quite a clunky way of achieving that. If the 2 businesses are comfortable sharing one LAN then the two secondary routers could be changed to access points so that all routing was handled by the main router.

In my opinion you should only ever use WiFi when you can't use wired. It's just not terribly robust.

I think a cloud deployment is perfect for testing / trying out as you can get a year for free from either 3CX or Google and deployment using PBX Express is very easy.

My client controls the internet connection, so we have full control over that router, except that it is not exactly a high spec device, and the ISP insists we use it.

However, I will probably try replacing it with something better that I can setup QoS on. The only downside is likely that the ISP won't support us if we have any trouble getting it configured, but worst case, I can just put their router back in if I have to.

I figure we'll go with this for now, and see how it goes, with a cloud option as our 'Plan B' if it doesn't work well enough.

Thanks,

Alan.

 

[Lee Cramman]

Hi cobaltit,



Unfortunately, there is no practical way to get an ethernet connection from the 3CX Server to the Outside-Router. There is only one cable run, which is already running to the Inside-Router, else I would definitely go wired if I could.

Alan.

You could consider co-locating the 3CX server and the main router.

Hi Lee,



My client controls the internet connection, so we have full control over that router, except that it is not exactly a high spec device, and the ISP insists we use it.

However, I will probably try replacing it with something better that I can setup QoS on. The only downside is likely that the ISP won't support us if we have any trouble getting it configured, but worst case, I can just put their router back in if I have to.

I figure we'll go with this for now, and see how it goes, with a cloud option as our 'Plan B' if it doesn't work well enough.

Thanks,

Alan.

A better solution might be to use the ISP supplied router in modem / bridge mode, then you can use whatever router you like in partnership with it without worrying about double NAT or breaking ISP T&Cs / support arrangements.

This article might be interesting for you to have a look at: https://www.howtogeek.com/255206/how-use-your-router-and-isps-modemrouter-combo-in-tandem/

As a recent convert to 3CX I started with an on premise server but after trying a cloud deployment I simply wouldn't go back as it so neatly sidesteps lots of issues and is inexpensive.

Anything you do to work around the double NAT and continue with the additional routing is, unfortunately, going to be a bit of a kludge...