FQDN not accessible from external Wifi, only internal and 3G/4G

[UPM_f]

Hello!

I seem to have a problem with my FQDN. Remote clients cannot connect to https://xyz.3cx.gr:5001 from their home internet connection, although it works fine from the office LAN and 3G/4G connections. It only seems to be a problem from home wifi networks, and not relevant to the home ISP of the users.

Any suggestions will be much appreciated.

Thank you.

 

[cobaltit]

First, some more info would help:

https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

Particularly about where 3CX is at and if the firewall checker passes.

Second, is this a brand new install and it never worked, or did it previously work and suddenly stop working?

Third, does it not reach or not resolve?

 

[leejor]

What type of remote clients are we talking about, all iOS, or all Android, a mix?
What about from a WiFi hotspot, has that ever worked?
Have you checked for blacklisted IP?
Have you looked at the 3CX Activity Log, for any errors?

 

[UPM_f]

Thank you for both of your replies, and sorry for not providing enough information.

3CX Version ,Standard Annual 16.0.7.1078 License
Server OS, Raspberry Pi 4, latest version - not sure which one it is at the moment. On premise.
Gateway is Beronet ISDN although not relevant for this problem I believe
Has the Firewall Checker passed: YES - all passes
Are custom Phone Templates being used: NO
Router/Firewall: EdgerouterX with a Static Public IP from ISP

It is a new install and this has never worked correctly.

Regarding not reaching or not resolving, I believe the answer is that it doesn't reach. If I do NSLOOKUP of the domain it does show the correct static public IP. But never loads.

Mobile clients are mixed, both iOS and Android. Same on both.

No blacklisted IPs on management console.

3CX Activity Log does have the following error Failed to send APNS PUSH to device iPhone10,6. Internal exception occured: The SSL connection could not be established, see inner exception.

Edit: Hotspot works too. Only home wifi doesn't work.

 

[ChrisC_3CX]

Hey @UPM_f
Just so that we first get a better understanding of the issue you are facing, what do you mean exactly when you say that users can't connect to https://xyz.3cx.gr:5001, are they actually trying to access the Management Console or Webclient but can't?

If not, are you merely assuming that they can't reach https://xyz.3cx.gr:5001 because the mobile clients do not work? If this is the case, what is the exact issue faced on the mobile clients?

• Are they not able to make or receive calls only?
• Are you not seeing any presence information(Can't see other extensions in the "Status" section, etc)?
• Do you get a specific error within the iOS or Android app?

Also, are you running the latest versions for both the iOS and Android 3CX clients?

 

[UPM_f]

Hey @UPM_f
Just so that we first get a better understanding of the issue you are facing, what do you mean exactly when you say that users can't connect to https://xyz.3cx.gr:5001, are they actually trying to access the Management Console or Webclient but can't?

If not, are you merely assuming that they can't reach https://xyz.3cx.gr:5001 because the mobile clients do not work? If this is the case, what is the exact issue faced on the mobile clients?

• Are they not able to make or receive calls only?
• Are you not seeing any presence information(Can't see other extensions in the "Status" section, etc)?
• Do you get a specific error within the iOS or Android app?

Also, are you running the latest versions for both the iOS and Android 3CX clients?

Thank you @ChrisC_3CX
Both iOS and Android are running the latest versions, yes.

The problem starts with mobile clients not being able to receive calls - nothing comes through to mobile clients. Webclient or MacOS App works fine.

Now, when they launch the mobile client from the internal wifi or 3G/4G networks, presence information loads and mobile clients are able to make calls - but not receive.
When the mobile client is launched through a home wifi network, presence doesn't load either, and thus cant make calls too. That's when I asked them to try accessing the Management Console and WebClient to see if this works, but doesn't.

Firewall no traffic is blocked and all ports are open. I have also set up Full Cone NAT without any luck and thats why I think that it may be a DNS/FQDN problem?

 

[ChrisC_3CX]

Hey @UPM_f

If you can resolve the FQDN correctly and can reach it locally that is enough to confirm that it is not an FQDN or Server related issue. Since you cannot reach the Management Console/webclient either, you might want to double check that your firewall configuration is in order, and also check for any other services the firewall might be running such as geo-location restrictions or any other security services that might be affecting the connection. If still the issue persists, you might want to consider looking into the ISP and CPE of the remote sites.

 

[UPM_f]

Thank you @ChrisC_3CX
It seems that port 443 is blocked. At least this is what a port forward checker tool shows. Although I have setup port forwarding it is still shows as closed. All the other ports are open. Could this be the problem?

 

[ChrisC_3CX]

If 443 is your HTTPS port then yes, that could very well be the reason. If your HTTPS is configured to be something else however, for instance 5001, then you should check port 5001 instead of 443. That said, using a port checker to determine whether it is open or not is not enough. I would recommend making sure that you can reach the 3CX Management Console from one of the affected remote locations.

 

[UPM_f]

If 443 is your HTTPS port then yes, that could very well be the reason. If your HTTPS is configured to be something else however, for instance 5001, then you should check port 5001 instead of 443. That said, using a port checker to determine whether it is open or not is not enough. I would recommend making sure that you can reach the 3CX Management Console from one of the affected remote locations.

Hello Chris, have just been advised from the ISP, that SIP ALG on their router (which is in Bridge Mode) is running and I have filed a request to disable it. Could this be the cause of the problem?

 

[ChrisC_3CX]

I doubt that SIP ALG would affect the 3CX Mobile Clients as they use the 3CX tunnel and therefore the SIP and RTP traffic is encapsulated.

Might as well let them disable it though since it's already been requested. If disabling it does not help and you have confirmed that reaching the Management Console from those same locations is possible but still the issue persists, you might want to consider contacting a 3CX Partner so that they can help you with troubleshooting, by performing a more in-depth investigation.

 

[UPM_f]

I doubt that SIP ALG would affect the 3CX Mobile Clients as they use the 3CX tunnel and therefore the SIP and RTP traffic is encapsulated.

Might as well let them disable it though since it's already been requested. If disabling it does not help and you have confirmed that reaching the Management Console from those same locations is possible but still the issue persists, you might want to consider contacting a 3CX Partner so that they can help you with troubleshooting, by performing a more in-depth investigation.

Thank you for the quick reply Chris. I thought so to be honest. The problem is I have already contacted the local 3CX Partner, and haven't helped much. Whatever they suggested I had already done, and regarding the router/firewall, they are not familiar with it and thus their only suggestion was to sell me completely new set up, router, firewall and 3CX Server (as they were against running 3CX on a Pi4). Which isn't really what I am after.

Going though the Management Console I can see that my device appears twice on the Devices menu. Once with my IP and once with an IP of 127.0.0.1.

Could this be a clue for something?

 

[NickD_3CX]

Going though the Management Console I can see that my device appears twice on the Devices menu. Once with my IP and once with an IP of 127.0.0.1.

No, this should have anything to do with it.

Alternatively, you might just need to speak with the Support Team of your Firewall vendor.
Explain to them the issue, then they should be able to help you at least determine if there are attempts to contact the HTTPS Port (5001 or 443) from the locations where WebClient isn't accessible from.

 

[UPM_f]

We are trying different setting with the Firewall but nothing solved it so far. I decided to test again with Android, and notifications for Android are working (on Local Network and Cellular). Still not working on other Wifi networks.
iOS no update yet.

 

[ChrisC_3CX]

Could you try the following:

• Access the Management Console.
• Go to Messaging
• Click on "Add Facebook"
• Click on "Test" in the upper right corner.

Let me know if it passes the test.

Note: This will test your configured HTTPS port.

 

[UPM_f]

Could you try the following:

• Access the Management Console.
• Go to Messaging
• Click on "Add Facebook"
• Click on "Test" in the upper right corner.

Let me know if it passes the test.

Note: This will test your configured HTTPS port.

It does pass with "success" yes.

 

[ChrisC_3CX]

I have to say that that is pretty strange, from your description of the issue everything points to the problem being firewall related but the fact that the test passes may prove otherwise. The issues you are experiencing are not in line with the test results so I think at this point you will definitely need to speak to someone for a more in-depth investigation of the issue.

I would recommend the following before doing so:

1. Make absolutely sure the firewall has been configured correctly and that there are no other services running on it contributing to the issue (security services, filtering, etc). Required ports here: https://www.3cx.com/docs/ports/

2. Re-flash and reinstall 3CX from scratch using this guide for the Pi 4: https://www.3cx.com/docs/installing-pbx-raspberry-pi/

3. Uninstall and re-install all affected 3CX Mobile Apps, then reprovision them.

If still the issue persists, please contact one of our 3CX Partners so that they can get in touch with 3CX Support and submit a support case for you.

 

[UPM_f]

I have to say that that is pretty strange, from your description of the issue everything points to the problem being firewall related but the fact that the test passes may prove otherwise. The issues you are experiencing are not in line with the test results so I think at this point you will definitely need to speak to someone for a more in-depth investigation of the issue.

I would recommend the following before doing so:

1. Make absolutely sure the firewall has been configured correctly and that there are no other services running on it contributing to the issue (security services, filtering, etc). Required ports here: https://www.3cx.com/docs/ports/

2. Re-flash and reinstall 3CX from scratch using this guide for the Pi 4: https://www.3cx.com/docs/installing-pbx-raspberry-pi/

3. Uninstall and re-install all affected 3CX Mobile Apps, then reprovision them.

If still the issue persists, please contact one of our 3CX Partners so that they can get in touch with 3CX Support and submit a support case for you.

Hello Chris,

thank you for your reply and suggestions. I will try this over the weekend and get back to you with further feedback.

Can I just confirm, when I re-install 3CX, I will not use a back up but will set it up from new. Should I release my FQDN and set up a new one? or keep my existing FQDN?

 

[ChrisC_3CX]

Ideally you would not use a backup to make sure that you start over with a clean slate. The FQDN does not really matter so you could release it or keep it according to your preference.

 

[UPM_f]

Ideally you would not use a backup to make sure that you start over with a clean slate. The FQDN does not really matter so you could release it or keep it according to your preference.

Hello @ChrisC_3CX ,
So I have now Re-flashed and reinstalled 3CX as per the instructions. I have now used different ports during setup, as I was advised by the ISP that port 5060 is blocked for use just for them. Reconfigured the firewall, re-provisioned the soft phone, and still the same problem.

One thing that I noticed, is that during all installations I have done, I never get the SSL Certificate during installation. It always fails. I proceed with a self-signed certificate. At the moment, I have not yet received the LetEncrypt certificate, it usually takes about 24 hours. Is this normal? Could this point us to something? Could it be a DNS problem?