Help! - Block WAN Request is on.

[JurisTekton]

We use the SMB Free system with 7 users and a Telxi SIP Tru,nk with 6 DiDs.

This morning five out of six of our DiD numbers are not working and do not receive incoming calls, including our main number. The only one that works is the router phone with the SBC on it. All phones can make outgoing calls.

j have just seen the following message in the Event Log:

SIP request (REGISTER) from 148.252.XXX.X7 was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER [Our 3CX cloud ID]:5060 SIP/2.0. Via: SIP/2.0/UDP 192.168.0.12:5060;branch=z9hG4bK799792087;received=148.252.XXX.X7. Max-Forwards: 70. Contact: <sip:[email protected]:5060>. To: "[NameofUser]" <sip:20312@[our 3CX cloud ID]5060>. From: "{name of user]" <sip:20312@[our 3cx cloud ID]5060>;tag=799583114. Call-ID: [email protected]. CSeq: 2 REGISTER. Expires: 120. Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE. Proxy-Authorization: Digest username="I[username]",realm="3CXPhoneSystem",nonce="414d5359001591b896:63fab9cc2d5a2deece9b7d8f1d3cd50c",uri="sip:[our 3CX cloud ID]5060",response="9c8cc54c8d739467d2ec56ca1831c19e",algorithm=MD5. User-Agent: Yealink SIP-T58 58.XX.0.XX 8XXXXXXXXXf7. Allow-Events: talk, hold, conference, refer, check-sync. Mac: XX:XX:XX.XX:XX:f7. Content-Length: 0

148.252.XXX.X7 is our current, dynamic public IP address and our ISP is using CG-NAT. We cannot do anything about that or change our IP addres. Why are calls from that address being rejected?

WE MUST RESOLVE THIS QUICKLY AS THIS IS A BUSINESS DAY AND WE ARE MISSING CALLS,

How do I unblock our IP address and stop this happening again?

 

[bitn2]

You need to fix the phones that are not using the sbc/router phone... You cant unblock your ip before this is done.

 

[JurisTekton]

You need to fix the phones that are not using the sbc/router phone... You cant unblock your ip before this is done.

Sorry if I wasn't clear. All the other phones are configured with the LAN IP address of the router phone (a Yealink T54W) as the outbound proxy address so they all use the SBC. All the phones were provisioned automatically by the 3CX system and this is how it set them up. It has all been working perfectly since we started using 3CX in February but this has happened without us changing anything and we need to get incoming calls back again ASAP.

 

[Alejandro_3CX]

SIP request (REGISTER) from 148.252.XXX.X7 was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER [Our 3CX cloud ID]:5060 SIP/2.0. Via: SIP/2.0/UDP 192.168.0.12:5060;branch=z9hG4bK799792087;received=148.252.XXX.X7. Max-Forwards: 70. Contact: <sip:[email protected]:5060>. To: "[NameofUser]" <sip:20312@[our 3CX cloud ID]5060>. From: "{name of user]" <sip:20312@[our 3cx cloud ID]5060>;tag=799583114. Call-ID: [email protected]. CSeq: 2 REGISTER. Expires: 120. Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE. Proxy-Authorization: Digest username="I[username]",realm="3CXPhoneSystem",nonce="414d5359001591b896:63fab9cc2d5a2deece9b7d8f1d3cd50c",uri="sip:[our 3CX cloud ID]5060",response="9c8cc54c8d739467d2ec56ca1831c19e",algorithm=MD5. User-Agent: Yealink SIP-T58 58.XX.0.XX 8XXXXXXXXXf7. Allow-Events: talk, hold, conference, refer, check-sync. Mac: XX:XX:XX.XX:XX:f7. Content-Length: 0

Make sure the phones are using the supported firmware listed here https://www.3cx.com/docs/phone-firmwares/

Remote phones must be behind the 3cx sbc or router phone, check that none of them are using stun because that is not supported.

 

[JurisTekton]

All the phones have the latest firmware and show green in the User Table. It usually says there when a firmware update is required. All the phones use use the router phone LAN IP address (which is static on our private LAN), all the phones are on the same LAN and none use STUN or any other NAT transversal method other than using the router phone. As I said, everything has been working perfectly for 8 months and, without us changing anything, incoming calls to the DiD numbers of every phone other than the router phone stopped working this morning. But how is the router phone working as it has the same public IP address as the other phones surely as we only have internet connection.

 

[bitn2]

The phone with the ip 192.168.0.12 isnt using the sbc to connect to the cloud. You need to check this...

 

[JurisTekton]

In the Register page of the web-ui for the phone with the IP address ending .12, the outbound proxy address is the IP address of the router phone so .12 is using the SBC as far as I can see. Nothing has changed from what it was last Friday and has been for months with no issue,

The only thing that has changed in the network is a new Drayek 2927LAX-5G router has replaced the former TP-Link router but even this was weeks ago, SIP ALG was switched on for a while at end of last week (not sure why) but it is now off. 5G is the only way we can get more than 40Mb/s speed as, despite being in the middle of London, there is no fibre to our building and the copper cables are degraded. 5G gives us around 850Mb/s to 1.8Gb/s as we are very close to a 5G mast but brings with it CG-NAT but the 3CX SBC coped with it perfectly and today is the first day we have lost service or any call has failed and the day is nearly over and who knows what business we have lost today. We have to get the phones working again.

 

[JurisTekton]

What has been most frustrating today has been the complete inability to contact anyone at 3CX to deal with this issue which needs their intervention as we cannot solve it ourselves. We have tried e-mailing [email protected] and [email protected] and were just rejected by saying they couldn't help and we should submit a ticket through our online account. The problem with that is you can't submit a ticket through the account for a SMB Free account so we are left unable to contact the only people who can lift the IP block..

I trawled the forum for a solution and saw this is not an uncommon occurrence and IP blocking seems to be an over-sensitive reaction by 3CX that they could do something about but don't. It is completely unacceptable for a business to be without phones for a whole day and however many further days this is going to continue. Even free services have service standards that are likely to have been breached by today's events. We are a legal consultancy and there is now talk of taking legal action against 3CX if we have lost or lose business due to an over-zealous policy and inability to contact anybody to deal with it.

Of course, we don't want to do that and we just want the phones to work again.

 

[SweetAction]

I would recommend getting in touch with a 3CX partner for expedited support. Also maybe don't run critical systems on a free platform with no SLA for support if you need instant support?

As mentioned in this thread several times, somehow the phones are not using the SBC and they are trying to register direct - this will need to be fixed. You could try factory resetting the phone and reprovisioning it as well.

 

[JurisTekton]

Thanks, Our ISP using CG-NAT means that our public IP address will change soon, It sometimes changes twice a day. We can't force a change by restarting the router but it will change soon enough; Not sure how or why one of our phones would suddenly start trying to connect direct rather than through the SBC as its settings indicate it should but appreciate the advice and I will re-provision it this evening so it won't start doing it again after the IP address changes and repeat the problem.

As for not using free services for critical systems, I agree but we were impressed by the 3CX system when we saw it in a friend's business and so decided to get a system for ourselves and invest in some decent Yealink phones - T54Ws and T58A/Ws. It is not our fault we are small at the moment so our demands are satisfied by the free version. We have been very pleased with the faultless operation of the system until today, which has been very frustrating as no solution was found. We would be willing to pay for the system given how happy we are with it but we are obviously pleased not to have an additional cost. We did not need any support to install or set-up the system or to deal with day to day operations and there has been no need for support before today when there was nothing we could do to solve the problem, Free or not, if we are to use the 3CX system (and we want to) we do need to be able to rely on it and that when there are problems that it is simply impossible for us to fix, for 3CX to be contactable and responsive.

I am grateful to everyone who took the time to respond to my appeal for help. We didn't find a solution during working hours as I hoped we might but it is great that there is a community like this willing to help out people they do not know.

 

[SweetAction]

Thanks, Our ISP using CG-NAT means that our public IP address will change soon, It sometimes changes twice a day.

This isn't the issue and a changed IP won't fix the issue either.

Not sure how or why one of our phones would suddenly start trying to connect direct rather than through the SBC as its settings indicate it should

That's a good question and I can't answer why this would happen without a lot more info / logs

As for not using free services for critical systems, I agree but we were impressed by the 3CX system

Personally I don't care one way or the other - use what's best for you. And while I love to help out, I do think posting in ALL CAPS (seen as shouting), making vague threats of legal action, and in general "complaining" about the lack of support on a free product, implying that you're losing business is a little... well, that's why I said don't run critical systems without support contracts.

It's like car or house insurance (I don't know how it works outside of the US to be honest) - you pay for something that you hope you never need (support), but have if the worse happens and you do need it (like right now).

Back on topic, your best bet going forward is to
1. Contact a 3CX partner for help, if you need it NOW
2. Rely on the 3CX forums, if you want (maybe) some help for free. Really up to people to help out though and they may not want to
3. Buy 3CX paid support

For #2, my advise is factory reset and reprovision the phones. If all your phones are router phones, I would make each one it's own router instead of using 1 as a router and relaying off it for the rest of the phones.

 

[JurisTekton]

I ended up contacting Telxi in the end who are our SIP Trunk provider and they could not have been more helpful. Even when I sent an e-mail to their support e-mail address at 9pm they responded in minutes, asked for details of the problem and said they would sort it out and we had incoming calls again when we started the next morning without having to change or reset anything at our end.

We then found that we could not make outgoing calls to UK landlines (calls to UK mobiles were fine) so I sent another e-mail to Telxi who again responded within minutes and having already got a report from their server and had identified that they were receiving the called number in the wrong format so they recommended I delete the outgoing call routing and create separate rules for landlines and mobiles. I didn't understand why the single rule that had work fine for 8 months would suddenly stop working for landlines but I did what they recommended and it worked and everything has been working perfectly again ever since.

I should have contacted Telxi straight await and it would have saved hours of stress and effort on my part with no resolution when they fixed the problem and a new one in minutes. They said that the initial problem was not one I could have fixed. Why couldn't 3CX be as helpful? If it was a configuration problem at our end, I can understand 3CX saying "its your problem, you sort it out" but when there is nothing we have done that caused the problem and nothing we can do to resolve it, surely 3CX should be obliged to help. What were we supposed to do? Say "oh well, it worked for a while for free but now it's broken so we have to abandon the system and get a new one"? Telxi were simply excellent and took ownership of the problem from receiving my first e-mail. OK, we do pay them for the SIP Trunk but not a huge amount and we are hardly their most valued customer yet they were on the case within minutes and restored our service so we did not have to endure a second day without phones. I cannot recommend Telxi high enough for their excellent support and customer service.

 

[paulodagraca]

If Telxi could help you within minutes, it means they already knew the solution to the problem.

Also, if Telxi was able to fix the issue on their end without anyone else’s involvement, it clearly shows the problem was within their own system. For a paid service, they should have resolved their *** service quickly.

You mentioned that nothing had changed and landlines were still unreachable. Yet within minutes, Telxi checked their own service and then asked you to adapt. Clearly, they had made a change and failed to properly inform customers—such as by posting a big, clear notice on their service page.

There has been no software fix or special update for 3CX.

As I understand it, 3CX worked as deployed once the correct Telxi outbound routing was in place. Again, Telxi should have informed you as a paying customer.

In my personal opinion, the 3CX software has been the best part of this situation. It’s free and supported by a helpful community where I and others freely assist users.

Regarding your question, “Why couldn’t 3CX be as helpful?”

The problem was never on 3CX’s side and was not visible to the 3CX staff.
I have never heard of 3CX being as rude as saying, “It’s your problem, you sort it out.” Even at a minimum, they try to help or point you to documentation, especially when the service is free.

Obviously, this is not the same as paying for a service, as you surely know.

3CX is always ready to help—if needed, 24/7 worldwide—not just in one country.

Long story short: pay for a service if you want guaranteed support, or try to fix it yourself (with the help of friends or others), but know it will never be as good or as fast as 3CX’s service.

And never compare free with paid—it’s simply not the same!