Solved Firewall tests, stun-eu.3cx.com and 51.91.201.8x

[Haxoy]

Hi,
Firewall tests are usually made from stun-eu.3cx.com.
At least for our location.
Today, running firewall tests, we got connections from 51.91.201.8x, which is not stun-eu.3cx.com.

3CX, did you put new STUN test servers into production ?
Do you have any FQDN for these new servers please ? (so that we can properly add them to our firewall rules)

Thank you for your support !

 

[Haxoy]

Here's a tcpdump, where we see 3CX asking for some domain names :

13:44:00.271624 IP 10.1.30.10.44789 > 8.8.8.8.53: 33268+ A? stun-eu.3cx.com. (33)
13:44:00.293746 IP 10.1.30.10.36887 > 8.8.8.8.53: 51986+ A? stun2.3cx.com. (31)
13:44:00.318644 IP 10.1.30.10.46060 > 8.8.8.8.53: 15002+ A? stun3.3cx.com. (31)
13:44:00.347570 IP 10.1.30.10.59551 > 8.8.8.8.53: 24850+ A? sip-alg-detector.3cx.com. (42)

Then it performs test 1 (as described here in the doc) :

13:44:01.823314 IP 10.1.30.10.5060 > 51.38.45.26.3478: SIP
13:44:01.838558 IP 51.38.45.26.3478 > 10.1.30.10.5060: SIP

And test 2 (as described here in the doc) :

13:44:02.039217 IP 10.1.30.10.5060 > 51.38.45.26.3478: SIP
13:44:02.054382 IP 51.91.201.86.3479 > 10.1.30.10.5060: SIP

However test 2 is not correct.
Answer should have come from 51.38.45.25, according to the doc :
If you are keen to see where the traffic should have come from, check your firewall logs. The IP address of the 3CX Stun servers are (-1) and the port is (+1).

51.38.45.26 is stun-eu.3cx.com, perfect.
But why answer comes from 51.91.201.86 ?!

3CX team, issue on your side ?

Thank you !

 

[Haxoy]

Any hint 3CX support ?
Thank you again !

 

[YiannisH_3CX]

Hello @Haxoy

We do have new Stun servers in place and the guide needs updating as the reply may come from a different IP now.

These are the new IP addresses:

51.38.45.26 stun.3cx.com

51.91.201.86 stun.3cx.com


54.39.182.217 stun2.3cx.com

51.79.116.90 stun2.3cx.com


54.37.20.144 stun3.3cx.com

151.80.120.125 stun3.3cx.com


54.39.188.150 stun4.3cx.com

54.39.75.88 stun4.3cx.com

 

[Haxoy]

Hello @YiannisH_3CX,

Thank you very much for your answer !

Will you then update your DNS zone accordingly ?
For now it does not contain these news hosts.

# getent hosts stun-eu.3cx.com
51.38.45.26 stun-eu.3cx.com
54.37.20.144 stun-eu.3cx.com

# getent hosts stun.3cx.com
54.39.182.217 stun.3cx.com
54.39.188.150 stun.3cx.com
51.38.45.26 stun.3cx.com
54.37.20.144 stun.3cx.com

# getent hosts stun2.3cx.com
54.39.182.217 stun2.3cx.com

# getent hosts stun3.3cx.com
54.37.20.144 stun3.3cx.com

# getent hosts stun4.3cx.com
54.39.188.150 stun4.3cx.com

Thank you again !

 

[YiannisH_3CX]

You are welcome.

The return servers do not actually need to come up when doing a DNS lookup but i will mention this and see if we can get them updated.

 

[Haxoy]

Good news @YiannisH_3CX, thank you again.
Having the DNS zone updated / maintained allows us to open our firewalls based on these known FQDN, which is rather practical.