Having 3CX Mobile app working on guest wifi behind NAT

[samlouis55]

Hello,

I have two WIFI in my enterprise: Corporate & Guest Wifi. Corporate is on the same lan than 3CX server and Guest wifi is behind a nat router. Employees users using 3CX android app can register using both wifi but with only the corporate wifi they can hear audio. I think they are unable using guest wifi cause of the nat issue. How can I overcome this? Sometimes audio is working for some using the guest wifi. I want to make sure audio is ok for both wifi. How can i overcome this? Should i deploy an SBC in the guest wifi segment?

Regards.

 

[AWS2P]

Hi,
Guest wifi is restricted rights by default , so you'd probably better ask your users to stay only on corporate network with no audio problem. Let them know that VOIP can 't be used on Guest

 

[samlouis55]

We want they stay on Guest wifi with VOIP capability. What is the solution for that?

 

[leejor]

Do the handsets running the Android App work (audio) , when using... a cafe hotspot, at their home, etc.? If so, and this has not been an issue in the past, then it could be something (setting) on the Guest LAN. Are all of the handsets using the 3CX Tunnel? If may be a STUN issue if there a re a number of handsets and they are all using the same, local port number..

Does the 3Cx firewall test, all pass, on the Corporate LAN?

Are both, in office Wifi LANs using the same SSID? If not, then have the handsets setup to NOT register on the Guest Network. That would be a quick fix.

 

[Saqqara]

Have you tried creating an DNS entry on the router to point your 3cx dns to 3cx server ip address on the guest network.

Create a rule to allow https (probably port 5001) and udp / tcp port 5090 from the guest network to the 3cx network , destination only has to be 3CX server IP address

 

[samlouis55]

My guest wifi is a small hotspot router and doesnt have those options. And if I deploy a SBC in guest wifi subnet?

 

[leejor]

I question why the emplyees would use the guest Wifi when the Corporate LAN is available. You are going to be going to a lot of effort to fix an issue, that does not have to happen.

 

[samlouis55]

Corporate LAN is for legitimate devices owned by the company. We cannot put employees phone that we don't manage in this corporate network.

 

[leejor]

Well then you might start by checking that all of the Android devices are set to use the 3CX Tunnel. If not, then they are using STUN, and as I said, phones will have to have different local ports assigned. Even then, unless you assign each device a static IP (or your router does, based on MAC), you will probably still have issues with the audio ports, as you can't really do any forwarding to dynamic IP's.

 

[cobaltit]

Forcing the apps to use the tunnel should solve your problems as @leejor mentioned.

 

[JohnS_3CX]

Have you tried the tunnel first? It's main goal is for better NAT traversal



Note: The NAT might not be the only issue, some Guest mode access points only allow normal browsing and email by restricting any other ports

 

[AWS2P]

We can talk about every kind of restrictions , may be quota execeed, time use restriction, day or hours in the week , protocols ,VOIP use , etc......

This is why my first answer was GUEST wifi is restricted by default, so why trying to use this.