HTTP and HTTPS

[Giuseppe Ravasio]

Hi,
I have a 3cx install on a private network that has the public ip address forwarded by a pfsense firewall.
the PBX hostname A record points on the public IP address both from the internal network and the public one.
All is working fine from the network perspective with the nat reflection enabled on pfsense.

The only problem is with HTTP and HTTPS on webclient.

If I access http://server.domain.com/webclient/ from a private ip address I can login but chrome doesn't allow audio and video without being clear about that.
If I access HTTP://server.domain.com/webclient/ from a public IP i get a "403 Forbidden" from NGINX

I think that having nginx on both cases redirecting HTTP to HTTPS would be the right thing to do!

Thanks
Giuseppe

 

[Saqqara]

'If I access HTTP://server.domain.com/webclient/ from a public IP i get a "403 Forbidden" from NGINX' - This is correct, you do not want unsecure traffic over the internet

What happens if you disable the nat reflection ,and setup DNS resolver to point your fqdn to the 3CX server IP address

 

[Giuseppe Ravasio]

'If I access HTTP://server.domain.com/webclient/ from a public IP i get a "403 Forbidden" from NGINX' - This is correct, you do not want unsecure traffic over the internet

What happens if you disable the nat reflection ,and setup DNS resolver to point your fqdn to the 3CX server IP address

I for sure don't want unsecure traffic, I want that traffic secured
Sometimes the users are writing on the browser the url and so they are getting a 403; that's confusing and causes support requests.
I know that some browsers will try HTTPS if they get a 403 on HTTP but that's far to be a standard behaviour.
The right way to do this is like every other HTTP service does, securing with a HTTP redirect.

If I disable the nat reflection and point to the local IP the bahaviour is the same and the user that wrote an URL in the browser is not secure, has a lot of problems and complains with the support desk.

Regards
Giuseppe

 

[JohnS_3CX]

Hello,

The HTTPS is a requirement for the webclient. WebRTC will not run in HTTP mode.

 

[Giuseppe Ravasio]

Hello,

The HTTPS is a requirement for the webclient. WebRTC will not run in HTTP mode.

That's exactly because you should do a redirect of HTTP to HTTPS and not allow the HTTP use both from internal and external clients.
Honestly I consider this a nginx configuration bug.

Regards
Giuseppe

 

[JohnS_3CX]

You should simply not connect to the HTTP session. We will allow HTTP on nginx because it affects other things too (so both modes should be available). Things like provisioning local phones or gateways that would fail since they cannot verify the certificate against a plain IP.

 

[Giuseppe Ravasio]

That's hard to have a bunch of users not connecting writing the url in their web browser and than complain about missing functionalities!

If the HTTP interface is so important you can redirect only the webclient location in the nginx config:

location /webclient/ {

return 301 https://3cx.domain.com$request_uri;

}

and have nginx redirect only webclient requests!

Also from the enduser perspective it's very hard having the console on the root of the webserver because everyone tries to login there and eventually get blacklisted!

Giuseppe

 

[JohnS_3CX]

I understand what you mean about the users getting blacklisted and indeed it makes sense when you first look at it from your angle, but it may not be a good idea to change it now that all the 3CX installations across the world use the current Webclient URL scheme.

Besides, as an admin, the welcome email takes care of all the problems you mentioned:

- Direct Link to webclient (both internal and external)
- Includes HTTPS in both links

If the users don't follow clear instructions, its neither the fault of the system nor the fault of the admin. And there is no point in changing the current URL scheme that 1000s of installations across the world currently use, simply because some users ignore instructions. Hopefully once they get blacklisted, they may be be incentivised to follow the below which is as simple as it gets..