I am being blocked...why?

[texmansru47]

I recently got an email from 3CX stating that they are blocking my SIP traffic. The note indicated that I am presenting a ton of bad hits. From checking around with mu ISP (who has my firewall that I had to open the ports from) these are coming from the 9000-10000 ports that I have to keep open per 3CX yet I don't use them since what they are associated too I am not using (As least I don't think I am). First are these hundreds of ports required for proper operation (outside the firewall test); 2nd how can I get my SIP back online... I am paying a monthly fee for that service and I cannot use it. Sounds to me that there is some setting that needs to be tweaked either by me or the 3CX folks. Any suggestions?

 

[cobaltit]

Is your SIP traffic or your RTP traffic being clocked? SIP is on a single port (5060 by default) but RTP range for 3CX is 9000-10999. Secondly, are you sure YOUR SIP trunk is being blocked? There's scripts scanning blocks of the internet and trying to hack into PBXes all the time using default credentials. Those will get blocked and you will get emails (if you enabled notifications). But if YOUR SIP trunk was blocked then it sounds like something happened on the provider side to make 3CX think it was doing something funny. The fix would be to find your provider IP(s) and delete them from the blacklist. Then add them back as whitelist entries which will prevent them from being blocked in the future should there be another hiccup.

 

[Evolute IT]

109999

Wow that's a nice port

 

[texmansru47]

Can I do that from my console server?

 

[cobaltit]

Wow that's a nice port

Whoops . Good catch

 

[cobaltit]

Can I do that from my console server?

Yes

https://www.3cx.com/docs/allow-deny-ip-addresses/

Err wait. Do you mean the dashboard/web interface or like terminal/SSH console? Yes from the dashboard, no from the console/terminal unless you start getting into the database. Easier to access from another IP/internet connection. Is your SIP trunk being blocked or is your management console access being blocked?

 

[texmansru47]

Is your SIP traffic or your RTP traffic being clocked? SIP is on a single port (5060 by default) but RTP range for 3CX is 9000-10999. Secondly, are you sure YOUR SIP trunk is being blocked? There's scripts scanning blocks of the internet and trying to hack into PBXes all the time using default credentials. Those will get blocked and you will get emails (if you enabled notifications). But if YOUR SIP trunk was blocked then it sounds like something happened on the provider side to make 3CX think it was doing something funny. The fix would be to find your provider IP(s) and delete them from the blacklist. Then add them back as whitelist entries which will prevent them from being blocked in the future should there be another hiccup.

I am getting the blocked notifications from 3CX from the scanning blocks action I believe. But I cannot call in or out via my SIP. I am not a professional phone guy but know some things. More of a network expert

 

[texmansru47]

Yes

https://www.3cx.com/docs/allow-deny-ip-addresses/

Err wait. Do you mean the dashboard/web interface or like terminal/SSH console? Yes from the dashboard, no from the console/terminal unless you start getting into the database. Easier to access from another IP/internet connection. Is your SIP trunk being blocked or is your management console access being blocked?

SIP Trunk.. I can get into my dashboard no problem

 

[Evolute IT]

I would consider hiring a 3CX Partner to help you further but check those things:

- Make sure ports are correctly forwarded through NAT
- Verify the blacklist.

Have you checked the Activity Log in verbose to see if anything even gets to the system? You can also try a packet capture.

 

[cobaltit]

I am getting the blocked notifications from 3CX from the scanning blocks action I believe. But I cannot call in or out via my SIP. I am not a professional phone guy but know some things. More of a network expert

Ok then check the blacklist for your SIP trunk IPs and remove them. Then add them back as whitelist entries. Don't change them from blacklist to whitelist.

 

[YiannisH_3CX]

Can you share the email you are getting here but conceal the important parts like names IP's and FQDN's? I am still trying to figure out what kind of email you are getting.

 

[texmansru47]

Sure... Here is one of them......

IP 18.156.78.183 has been blacklisted on PBX - xxxxxxxx.3cx.us​

3CX-Home VOIP

3CX Communication System - Home <[email protected]>​	Mon, Apr 26, 10:58 PM
to me

�







The IP 18.156.78.183 on PBX xxxxxxxx.3cx.us has been blacklisted and will expire on: 2021/04/27 12:51:55
Affected Module: SIP Server
User agent: Hello SIP Automated

Reason: Requests rate is too high!

This IP Address 18.156.78.183 has made numerous attempts to authenticate with 3CX with invalid details. In response, 3CX has created a blacklist rule denying this IP to continue sending requests.

No action is required on your behalf.

If you would like to review, edit or delete the rule, you can do so from 3CX Management Console > Dashboard > IP Blacklist.

For more information: https://www.3cx.com/docs/allow-deny-ip-addresses/

 

[jcostlow]

The one you posted is saying that IP 18.156.78.183 was blacklisted for trying to authenticate with incorrect credentials too frequently. From ARIN this is an amazon IP: https://search.arin.net/rdap/?query=18.156.78.183

We have this happen all the time by bots looking for IPs with SIP open.

Is the trunk showing as registered? Just asking since you said in first post that the trunk is offline.

 

[YiannisH_3CX]

This looks normal to be honest as it just means the PBX is doing its job and blocking unauthorized access and registrations to the PBX.
If you do not know that IP it means that bots are scanning your IP range and trying to randomly authenticate which the PBX is blocking. If you know the IP then it means that a device or devices are trying to register to the PBX using the wrong credentials so you should check what is happening.

 

[texmansru47]

I guess where I am getting confused is why is my actual SIP trunks (I have two) are not working now? I get a dial tone but when I try to call anyone... fast busy... It started with those emails but that could have been a fluke.

 

[YiannisH_3CX]

I think you may need to treat that as a separate issue and troubleshoot it independently. I would start with the activity log of the PBX. Navigate to dashboard / Activity log / Settings and enabled Verbose logging for maximum details. Then try to make a call and check the activity log for an error. You can filter by call so just select the last call from the filter and see why the call fails.
If you are familiar with Wireshark you can also run a packet capture from the Activity Log menu and go through that as well.

Also do calls from extension to extension work?

 

[YiannisH_3CX]

Also can you tell me the registrar/IP address of your provider just to make sure that that is not the IP that is getting blacklisted?

 

[texmansru47]

I can post that this evening when I get home for sure.