i got this issue when i run the Firewall Check

[bitn2]

1. No
2. No

 

[irfan2]

can u provide a confirmation that can i use 3cx hosted in UAE region and can i provide it to customers?

pls reply

 

[Alphabetic]

As mentioned by @NicholasP_3CX you should reach out to a 3CX partner in the UAE for further assistance

 

[irfan2]

if it have a CGNAT issue can i use additional router or firewall to overcome this is

?

 

[Alphabetic]

?

no.

 

[irfan2]

can you tell me how can i integrate 3cx on-premise with 3cx self hosted cloud ?just explain the steps

 

[Alphabetic]

You need to log in to customer.3cx.com and select "switch to hosted" on your license key.

 

[irfan2]

can u suggest a cheaper way to connect by using vpn with cloud?pls reply

 

[bitn2]

Oh man... Please do your self a favor and have a look for a 3cx partner to help you. Thats not working at all what you are trying to do.

 

[Alphabetic]

You dont need VPN, just an sbc. Go to hosted or contact a partner. if you're looking for cheap, look up FreePBX and then you'll still have a problem with your firewall

 

[irfan2]

To set up a VPN tunnel between your on-premise 3CX and a cloud instance to bypass firewall issues, here is a step-by-step guide using OpenVPN on a cloud provider, like Oracle Cloud or digital ocean. This setup provides a secure, single port tunnel, minimizing firewall configuration needs.

Prerequisites

1. A cloud account on Oracle Cloud (Free Tier), DigitalOcean, or another provider.

1. Access to your on-premise 3CX server and your firewall/router settings.

Step 1: Set Up a Cloud Instance

1. Sign in to your cloud provider (Oracle or DigitalOcean).

1. Create a Virtual Machine (VM):

1. Choose a small instance type, like Oracle’s Free Tier VM or a DigitalOcean droplet.

1. Select Ubuntu or Debian as the operating system (works well with OpenVPN).

1. Configure Networking:

1. Assign a static IP to the VM (some providers include this for free).

1. Open port 1194 (UDP) in your cloud provider’s firewall settings for OpenVPN (or choose TCP if required).

Step 2: Install OpenVPN on the Cloud Server

1. Connect to your Cloud VM:

1. Use SSH to connect to your instance:

ssh user@your-cloud-ip

1. Install OpenVPN:

1. Update the package list:

sudo apt update

1. Install OpenVPN and Easy-RSA:

sudo apt install openvpn easy-rsa

1. Configure Easy-RSA for Certificate Generation:

1. Make the Easy-RSA directory:

make-cadir ~/easy-rsa
cd ~/easy-rsa

1. Initialize PKI and create certificates for the server and client.

1. Configure OpenVPN:

1. Create and edit the OpenVPN server configuration file (/etc/openvpn/server.conf) with basic VPN settings.

1. Make sure port 1194 and proto udp are set (adjust to TCP if needed).

1. Start OpenVPN:

1. Enable and start OpenVPN:

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server


Step 3: Configure OpenVPN on the On-Premise 3CX Server

1. Install OpenVPN Client on your 3CX server if it’s a Linux machine, or download the client on Windows.

1. Import the VPN Configuration:

1. Transfer the VPN configuration file generated from the cloud instance to the 3CX server.

1. Start the OpenVPN client on the 3CX server and connect using this configuration.

Step 4: Adjust Firewall Settings

1. Firewall Adjustment on 3CX Location:

1. Open only port 1194 (UDP) (or the port you configured) for outgoing VPN traffic.

1. No additional SIP or media ports need to be configured for NAT, as all 3CX traffic will route over the VPN.

1. Test the VPN Connection:

1. Once the VPN is active, ensure your on-premise 3CX can communicate through the VPN tunnel to the cloud instance.

Step 5: Configure 3CX to Use the VPN Connection

1. Set 3CX Server to Use VPN IP:

1. In your 3CX management console, configure it to communicate through the VPN IP addresses.

1. Test Calls and Connections:

1. Test internal and external calls to confirm that the VPN tunnel is handling the traffic properly.

is this method is possible in real life scenario ?Can u please suggest how can i search for it?

 

[bitn2]

To set up a VPN tunnel between your on-premise 3CX and a cloud instance to bypass firewall issues, here is a step-by-step guide using OpenVPN on a cloud provider, like Oracle Cloud or digital ocean. This setup provides a secure, single port tunnel, minimizing firewall configuration needs.

Prerequisites

1. A cloud account on Oracle Cloud (Free Tier), DigitalOcean, or another provider.
2. Access to your on-premise 3CX server and your firewall/router settings.

Step 1: Set Up a Cloud Instance

1. Sign in to your cloud provider (Oracle or DigitalOcean).
2. Create a Virtual Machine (VM):
3. Choose a small instance type, like Oracle’s Free Tier VM or a DigitalOcean droplet.
4. Select Ubuntu or Debian as the operating system (works well with OpenVPN).
5. Configure Networking:
6. Assign a static IP to the VM (some providers include this for free).
7. Open port 1194 (UDP) in your cloud provider’s firewall settings for OpenVPN (or choose TCP if required).

Step 2: Install OpenVPN on the Cloud Server

1. Connect to your Cloud VM:
2. Use SSH to connect to your instance:

ssh user@your-cloud-ip

1. Install OpenVPN:
2. Update the package list:

sudo apt update

1. Install OpenVPN and Easy-RSA:

sudo apt install openvpn easy-rsa

1. Configure Easy-RSA for Certificate Generation:
2. Make the Easy-RSA directory:

make-cadir ~/easy-rsa
cd ~/easy-rsa

1. Initialize PKI and create certificates for the server and client.

1. Configure OpenVPN:
2. Create and edit the OpenVPN server configuration file (/etc/openvpn/server.conf) with basic VPN settings.
3. Make sure port 1194 and proto udp are set (adjust to TCP if needed).
4. Start OpenVPN:
5. Enable and start OpenVPN:

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server


Step 3: Configure OpenVPN on the On-Premise 3CX Server

1. Install OpenVPN Client on your 3CX server if it’s a Linux machine, or download the client on Windows.
2. Import the VPN Configuration:
3. Transfer the VPN configuration file generated from the cloud instance to the 3CX server.
4. Start the OpenVPN client on the 3CX server and connect using this configuration.

Step 4: Adjust Firewall Settings

1. Firewall Adjustment on 3CX Location:
2. Open only port 1194 (UDP) (or the port you configured) for outgoing VPN traffic.
3. No additional SIP or media ports need to be configured for NAT, as all 3CX traffic will route over the VPN.
4. Test the VPN Connection:
5. Once the VPN is active, ensure your on-premise 3CX can communicate through the VPN tunnel to the cloud instance.

Step 5: Configure 3CX to Use the VPN Connection

1. Set 3CX Server to Use VPN IP:
2. In your 3CX management console, configure it to communicate through the VPN IP addresses.
3. Test Calls and Connections:
4. Test internal and external calls to confirm that the VPN tunnel is handling the traffic properly.

is this method is possible in real life scenario ?Can u please suggest how can i search for it?

Just no! Please stop doing any crazy stuff and listen to the people they trying to help you.

 

[irfan2]

Other than this integration i have a doubt "Is it possible to host multiple 3CX instances on a single server to provide separate PBX services for different customers? If so, how can I ensure each instance is securely isolated and managed efficiently? I’m looking for best practices or any resources that can guide me through setting this up in a multi-tenant environment."

 

[bitn2]

You jumping from one thing to the next. Please have a look for a partner that can help you with network und pbx.

 

[irfan2]

Not like that sir, this is a doubt raised by my team lead to ask in community i need answer only when anyone knows about this or aware with this in here

 

[bitn2]

Not like that sir, this is a doubt raised by my team lead to ask in community i need answer only when anyone knows about this or aware with this in here

That has nothinh to do with your firewall your starting here. please stay at one thing and dont start many new things. You are not capable to fix the first thing, why are you trying alot more complicated stuff before you are able to fix the easy stuff.

 

[irfan2]

i just want to give him information about that stuff and i can assist him for that . if anyone knows about that let me inform

 

[bitn2]

I am out, you are not listening to anything....

 

[Oliver Broad]

Was the original port mapping issue ever resolved?

If not it looked remarkably like the issue I had getting 3CX to work behind a "Business Smart Hub 2" router.

The problem was due to how ports were forwarded, forwarding only happens for INBOUND connections, OUTBOUND connections used the default NAT function which remaps ports.

The partial solution was to use the router's DMZ function instead of port forwarding. There's an important caveat though, this makes ALL ports reachable including port 22 (SSH) so to be safe I added a rule to forward port 22 to nowhere because I don't want to expose it.

Other than that putting 3CX in DMZ just works.

Regarding using 3CX cloud with a SBC, I haven't configured one but as I understand it the SBC is responsible for connecting to the cloud instance and the SBC creates a secure tunnel by itself it doesn't need a VPN

Oh and for multiple customers on the same host that would be multi-tennant. Alternatinvely you'd need multiple virtual machines each with its own IP address, good luck with that...

 

[Alphabetic]

Was the original port mapping issue ever resolved?

If not it looked remarkably like the issue I had getting 3CX to work behind a "Business Smart Hub 2" router.

The problem was due to how ports were forwarded, forwarding only happens for INBOUND connections, OUTBOUND connections used the default NAT function which remaps ports.

The partial solution was to use the router's DMZ function instead of port forwarding. There's an important caveat though, this makes ALL ports reachable including port 22 (SSH) so to be safe I added a rule to forward port 22 to nowhere because I don't want to expose it.

Other than that putting 3CX in DMZ just works.

Regarding using 3CX cloud with a SBC, I haven't configured one but as I understand it the SBC is responsible for connecting to the cloud instance and the SBC creates a secure tunnel by itself it doesn't need a VPN

Oh and for multiple customers on the same host that would be multi-tennant. Alternatinvely you'd need multiple virtual machines each with its own IP address, good luck with that...

Did you see the part where he's on CGNAT? Aint no BT hub in UAE