firewall

[Ironpel]

hello, i have a problem with firewall , whats happen?

 

[cobaltit]

I'm not 100% sure but it looks like SIP ALG is on.

 

[Ironpel]

Hello

You were right it was a problem on router with SIP ALG, thanks for the help, so i changue SIP ALG on the router to OFF and now works okey, but i keep having a problem on checking on the 3CX Media Server some are like "done" but other fails, how i could solve that?



Thanks

 

[AWS2P]

how is your rule for RTP ports?
UDP 9000 to 10999 ?

 

[JohnS_3CX]

It's either because the firewall is misconfigured or not behaving as required.

If you run the test a few times, is it always the same ports that fail or does this change with each run?

 

[Ironpel]

no, each time its diferents, and wirh firewall turn off it work good

thanks

 

[JohnS_3CX]

no, each time its diferents, and wirh firewall turn off it work good

thanks

Then it's quite possible that your firewall may interpret the test as "an attack" and may be throttling down the access.

Are you sure though that you opened the entire range 9000-10999 UDP as direct 1:1 portforwards (NOT port triggering) ?

Read up a bit on full-cone NAT, and then learn how to open ports this way on your specific firewall

 

[Ironpel]

We have had and configured the 3cx pbx on other occasions and we have opened the ports correctly, I attach a port capture, we have even tried to make a DMZ to the pbx ip and it still gives the same problem

 

[Ironpel]

the service works but the firewall turns red and we have that problem,

 

[Ironpel]

 

[JohnS_3CX]

How is your system connected? For example:

PBX Machine -> Firewall -> ISP Modem -> Internet ?

 

[Ironpel]

pbx->router ISP(firewall)->internet

 

[JohnS_3CX]

In this case you should find out whether the ISP router can provide either Bridge mode to bypass their firewall entirely, install your own firewall/router and control the ports by yourself.

 

[Ironpel]

We are running the debian version of 3cx on a HYPER-V virtual machine in the Windows server datacenter. Maybe the Windows server firewall settings have something to do with it. We will review what you have told us and verify it. Thanks, I keep them updated and publish so that other users can use my query to see if we can resolve a greeting

 

[JohnS_3CX]

If you are inside a VM then the Windows host VM server should not really affect you.

You can always use the PCAP feature of 3CX to investigate further if you are interested:
https://www.3cx.com/docs/capture-network-traffic/

 

[Ironpel]

hello

i send pcap check thanks

 

[JohnS_3CX]

Hi,

Unfortunately I cannot help you with that, and it alone will not tell you why there is a failure, it will just confirm the failure.

The specific capture needs to be compared with the equivalent capture running off the ISP hardware (otherwise its not of much use to you)

Here is what out test checks, it may help you understand what it's doing and why.
https://www.3cx.com/docs/firewall-checker/

Then you need to look at the specific ports that will fail at that given test