Having problems with firewall

[mevans91]

Hi everyone,

I'm having problems with my firewall configuration. I have forwarded ports 9000-9500 to the 3cx server (at 192.168.1.22).

When I run the firewall checker, about 10% of the ports randomly fail the firewall test.
For example, on test 1 ports 9019-9022 (and a bunch of others) will fail but then on test 2 they'll be fine but 9022-9043 will fail instead.

Any ideas as to what is going on, or what I should check?

Thanks,
Matt

 

[pact]

Hi Matt,

What router/firewall are you running?

 

[Zacharias_3CX]

Hello @mevans91

It would be very helpful if you show us what you have configure as port forward to your firewall. If it is possible add a screenshot.

 

[mevans91]

I believe it's an Arris 1652G.

Here is the port forwarding setup from the router:
https://gyazo.com/c829e74750019e8d2be2f76d6a4603fd
https://gyazo.com/f91f5dc65cd04a0cd25c26003662a908

Here's the result (partial) from the 3cx firewall test.
1.
https://gyazo.com/a8e4ff051fb385211dbabd1f2a618920
2.
https://gyazo.com/14db348bf5cb501d2441ba77e73b6cd3
3.
https://gyazo.com/ef398fa25185b5132b9f8b9f536e5e72

Strange, right?

Matt

 

[Zacharias_3CX]

The best way to understand the cause of this issue would be running a Wireshark and make a capture when doing the firewall test. This will show you why your PBX is failing to pass the test.

See the guide below for more details:

https://www.3cx.com/blog/docs/use-wireshark-to-capture-network-traffic/

 

[mevans91]

Hm. Okay.
I'll see if I can get wireshark to work, I haven't used it in linux before.

Matt

 

[StefanW]

best to use then tcpdump as the install is simpler.

and then run this command
https://www.wireshark.org/docs/wsug_html_chunked/AppToolstcpdump.html
and stop with crtl + c

 

[craigreilly]

I had this issue with my Miktrotik until a fairly recent firmware update. Port failure was random but system always seemed to work fine and stable.

 

[OCWI]

Any SIP ALG involved anywhere? Disable that, it may also be worth a call to your ISP to ensure your modem is in "STRAIGHT bridge" mode. For some reason ISP's lately have internally defined a difference between bridge mode and straight bridge mode.

 

[DSXVOICE]

ALG will consistently break, not a likely cause of random behavior. Might be an aggressive intrusion detection feature on the router. That router has an integrated VOIP client which can most certainly wreak havoc. If you can put it in bridge mode and use your own "known-good" router, you will probably be happier.

 

[OCWI]

In our experience the ISP's ALG is almost always the cause of random behavior. In our are we have Charter/Spectrum.