Toggle sidebar Toggle sidebar

Installing 3CX on-premise with dual LAN + commercial cert

Status
Not open for further replies.

msutherland25

New User
Joined
Nov 20, 2023
Messages
14
Reaction score
2
Hi there, really sorry if this has been covered elsewhere! I'm a newbie but experienced in both Linux and SIP VoIP systems and currently have an Asterisk based system. I am trying to install 3CX with the same arrangements as my current system where I have dual LANs with one having a public IP and the other an internal IP which is on a VLAN that only carries voice traffic. I thought to start with the outside LAN, but the installation will not allow the the network settings to be applied and it must connect to 3CX it seems to download a license. It is possible to setup the network interfaces fully in some way?

I also created a DNS record to make it easy to get to the pbx from outside, but during installation it then asks me to upload the certificate. Surely it should create a CSR first with a private key which I can then use to get a commercial certificate and this I would need to upload along with root and intermediate certs?

I am stuck at the certificate step and using one LAN port on DHCP to allow me to access it.

Any pointers would really be appreciated. Thank you
 
msutherland25 said:
I thought to start with the outside LAN, but the installation will not allow the the network settings to be applied and it must connect to 3CX it seems to download a license.
Click to expand...
So you are correct, during setup you want to choose the LAN that has internet access, then add the internal LAN afterwards to the OS. What error are you getting exactly?

Note: This is an unsupported config, although it can work.
msutherland25 said:
I also created a DNS record to make it easy to get to the pbx from outside, but during installation it then asks me to upload the certificate. Surely it should create a CSR first with a private key which I can then use to get a commercial certificate and this I would need to upload along with root and intermediate certs?
Click to expand...
Yes, make your cert outside of 3CX and upload it when prompted.
 
  • Like
Reactions: NatalyS_3CX and jed
  • Like
Reactions: jed
Thank you. I've managed to do the certificate fine and initial config is done. I have then changed the network config to static (completely different IP range to initial DHCP one) and have no problem connecting to this IP with SSH but no GUI seems to work. Outbound traffic is no problem and DNS correctly configured so that I can ping hosts. If I use netstat -an it shows nothing is listening on port 443 although this is allowed by the firewall rules. Has changing the IP had this effect? Do I need to change some other config (eg. webserver config)? What is the correct port and path needed to get to the configuration GUI please? The fqdn is voice.ukgastech.co.uk
 
  • Like
Reactions: jed
After changing the IP you will want to reboot the machine so 3CX can reload / reapply network settings from the host.
The FQDN should be fine, but you can test inside the network with the internal IP. The port will only be 443 if that's what you set during install - sometimes people use 5001 instead.

a netstat looking for what ports nginx is listening on will help here.
 
  • Like
Reactions: NatalyS_3CX and jed
Hi SweetAction, thank you for replying. I have indeed re-booted and same issue. netstat -an shows that it is not listening on port 80/443 or indeed 5001 either. I don't remember seeing any ability to change the management port during install, but even so, I did not change. Here is the output from netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:5060 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5484 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5485 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5482 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5008 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5004 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5432 127.0.0.1:36176 ESTABLISHED
tcp 0 0 127.0.0.1:52194 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53010 ESTABLISHED
tcp 0 0 127.0.0.1:38838 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:53024 127.0.0.1:5485 ESTABLISHED
tcp 0 0 127.0.0.1:52200 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:38828 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:52200 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:38830 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53080 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:38852 ESTABLISHED
tcp 0 0 127.0.0.1:38830 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53056 ESTABLISHED
tcp 0 0 127.0.0.1:53030 127.0.0.1:5485 ESTABLISHED
tcp 0 0 127.0.0.1:53084 127.0.0.1:5485 ESTABLISHED
tcp 0 264 89.206.205.196:22 80.168.79.2:62048 ESTABLISHED
tcp 0 0 127.0.0.1:36200 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:36216 ESTABLISHED
tcp 0 0 127.0.0.1:5004 127.0.0.1:56184 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:56118 ESTABLISHED
tcp 0 0 127.0.0.1:38852 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:36190 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:36162 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:38838 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:36190 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53070 ESTABLISHED
tcp 0 0 127.0.0.1:53080 127.0.0.1:5485 ESTABLISHED
tcp 0 0 127.0.0.1:5004 127.0.0.1:56156 ESTABLISHED
tcp 0 0 127.0.0.1:53056 127.0.0.1:5485 ESTABLISHED
tcp 0 0 127.0.0.1:5004 127.0.0.1:56172 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:38862 ESTABLISHED
tcp 0 0 127.0.0.1:38818 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:52212 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:38828 ESTABLISHED
tcp 0 0 127.0.0.1:5004 127.0.0.1:56198 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:36200 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53024 ESTABLISHED
tcp 0 0 127.0.0.1:56118 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53084 ESTABLISHED
tcp 0 0 127.0.0.1:36176 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53030 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:36162 ESTABLISHED
tcp 0 0 127.0.0.1:38862 127.0.0.1:5482 ESTABLISHED
tcp 0 0 127.0.0.1:52212 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:5485 127.0.0.1:53046 ESTABLISHED
tcp 0 0 127.0.0.1:53070 127.0.0.1:5485 ESTABLISHED
tcp 0 0 89.206.205.196:22 180.101.88.223:26990 ESTABLISHED
tcp 0 0 127.0.0.1:53010 127.0.0.1:5485 ESTABLISHED
tcp 0 0 127.0.0.1:53046 127.0.0.1:5485 ESTABLISHED
tcp 0 0 127.0.0.1:36216 127.0.0.1:5432 ESTABLISHED
tcp 0 0 127.0.0.1:5432 127.0.0.1:52194 ESTABLISHED
tcp 0 0 127.0.0.1:5482 127.0.0.1:38818 ESTABLISHED
udp 0 0 127.0.0.1:60127 127.0.0.1:60127 ESTABLISHED
udp 0 0 127.0.0.1:52183 127.0.0.1:52183 ESTABLISHED
udp 0 0 127.0.0.1:56546 127.0.0.1:56546 ESTABLISHED
udp 0 0 127.0.0.1:48401 127.0.0.1:48401 ESTABLISHED
udp 0 0 127.0.0.1:36273 127.0.0.1:36273 ESTABLISHED
udp 0 0 127.0.0.1:56768 127.0.0.1:56768 ESTABLISHED
udp 0 0 127.0.0.1:44669 127.0.0.1:44669 ESTABLISHED
udp 0 0 127.0.0.1:48801 127.0.0.1:48801 ESTABLISHED
udp 0 0 127.0.0.1:48808 127.0.0.1:48808 ESTABLISHED
udp 0 0 127.0.0.1:49104 127.0.0.1:49104 ESTABLISHED
udp 0 0 127.0.0.1:57304 127.0.0.1:57304 ESTABLISHED
udp 0 0 127.0.0.1:40925 127.0.0.1:40925 ESTABLISHED
udp 0 0 127.0.0.1:33015 127.0.0.1:33015 ESTABLISHED
udp 0 0 127.0.0.1:53603 127.0.0.1:53603 ESTABLISHED
udp 0 0 127.0.0.1:37279 127.0.0.1:37279 ESTABLISHED
udp 0 0 127.0.0.1:33306 127.0.0.1:33306 ESTABLISHED
udp 0 0 127.0.0.1:53942 127.0.0.1:53942 ESTABLISHED
udp 0 0 127.0.0.1:33498 127.0.0.1:33498 ESTABLISHED
udp 0 0 127.0.0.1:37680 127.0.0.1:37680 ESTABLISHED
udp 0 0 0.0.0.0:5060 0.0.0.0:*
udp 0 0 127.0.0.1:5063 0.0.0.0:*
udp 0 0 127.0.0.1:5080 0.0.0.0:*
udp 0 0 127.0.0.1:58332 127.0.0.1:58332 ESTABLISHED
udp 0 0 127.0.0.1:37900 127.0.0.1:37900 ESTABLISHED
udp 0 0 127.0.0.1:37982 127.0.0.1:37982 ESTABLISHED
udp 0 0 127.0.0.1:46238 127.0.0.1:46238 ESTABLISHED
udp 0 0 127.0.0.1:50486 127.0.0.1:50486 ESTABLISHED
udp 0 0 127.0.0.1:5483 0.0.0.0:*
udp 0 0 127.0.0.1:34168 127.0.0.1:34168 ESTABLISHED
udp 0 0 127.0.0.1:46901 127.0.0.1:46901 ESTABLISHED
udp 0 0 127.0.0.1:47012 127.0.0.1:47012 ESTABLISHED
udp 0 0 127.0.0.1:47121 127.0.0.1:47121 ESTABLISHED
udp 0 0 127.0.0.1:47571 127.0.0.1:47571 ESTABLISHED
udp 0 0 127.0.0.1:51812 127.0.0.1:51812 ESTABLISHED

The IP that I'm currently using is 89.206.205.196 but of course an entry for this or 0.0.0.0 is what I'm looking out for. It is listening on 5060 & 22 quite fine? Is there some setting elsewhere that needs changing please?

Thank you
 
What's the result of
Code: 
netstat -tulpen| grep nginx
and
Code: 
netstat -tulpen| grep 3CX*
 
root@voice:~# netstat -tulpen| grep nginx
root@voice:~# netstat -tulpen| grep 3CX*
tcp 0 0 0.0.0.0:5060 0.0.0.0:* LISTEN 999 107926 87118/3CXPhoneSyste
tcp 0 0 127.0.0.1:5485 0.0.0.0:* LISTEN 999 107903 30817/3CXSLDBServ
tcp 0 0 127.0.0.1:5482 0.0.0.0:* LISTEN 999 106781 87118/3CXPhoneSyste
tcp 0 0 127.0.0.1:5008 0.0.0.0:* LISTEN 999 106912 87319/3CXGatewaySer
tcp 0 0 127.0.0.1:5004 0.0.0.0:* LISTEN 999 108632 87119/3CXManagement
tcp6 0 0 :::5090 :::* LISTEN 999 102575 566/3CXMediaServer
tcp6 0 0 :::5060 :::* LISTEN 999 107929 87118/3CXPhoneSyste
tcp6 0 0 ::1:5008 :::* LISTEN 999 106913 87319/3CXGatewaySer
udp 0 0 0.0.0.0:5060 0.0.0.0:* 999 107921 87118/3CXPhoneSyste
udp 0 0 127.0.0.1:5063 0.0.0.0:* 999 102603 87119/3CXManagement
udp 0 0 127.0.0.1:5080 0.0.0.0:* 999 102581 566/3CXMediaServer
udp 0 0 127.0.0.1:5483 0.0.0.0:* 999 106808 87167/3CXIVR
udp6 0 0 :::5060 :::* 999 107932 87118/3CXPhoneSyste
udp6 0 0 :::5090 :::* 999 102576 566/3CXMediaServer
 
root@voice:/# find -name nginx*
./usr/share/man/man8/nginx.8.gz
./usr/share/3cxpbx/nginx-modified.conf
./usr/share/3cxpbx/skel/Bin/nginx
./usr/share/vim/registry/nginx.yaml
./usr/share/vim/addons/indent/nginx.vim
./usr/share/vim/addons/ftdetect/nginx.vim
./usr/share/vim/addons/syntax/nginx.vim
./usr/share/vim/addons/ftplugin/nginx.vim
./usr/share/doc/nginx
./usr/share/doc/nginx-common
./usr/share/nginx
./usr/lib/systemd/system/nginx.service
./usr/sbin/nginx
find: ‘./proc/87119/task/100303’: No such file or directory
./var/log/nginx
./var/lib/3cxpbx/Bin/nginx
./var/lib/3cxpbx/Bin/nginx/conf/nginx.conf
./var/lib/dpkg/triggers/nginx-reload
./var/lib/dpkg/info/nginx-common.preinst
./var/lib/dpkg/info/nginx-common.prerm
./var/lib/dpkg/info/nginx-common.templates
./var/lib/dpkg/info/nginx.list
./var/lib/dpkg/info/nginx-common.conffiles
./var/lib/dpkg/info/nginx.md5sums
./var/lib/dpkg/info/nginx.prerm
./var/lib/dpkg/info/nginx.triggers
./var/lib/dpkg/info/nginx-common.config
./var/lib/dpkg/info/nginx-common.list
./var/lib/dpkg/info/nginx-common.postinst
./var/lib/dpkg/info/nginx-common.postrm
./var/lib/dpkg/info/nginx-common.md5sums
./var/lib/dpkg/info/nginx.postinst
./var/lib/nginx
./var/lib/systemd/deb-systemd-helper-enabled/nginx.service.dsh-also
./var/lib/systemd/deb-systemd-helper-enabled/multi-user.target.wants/nginx.service
./var/cache/apt/archives/nginx-common_1.22.1-9_all.deb
./var/cache/apt/archives/nginx_1.22.1-9_amd64.deb
./etc/ufw/applications.d/nginx
./etc/init.d/nginx
./etc/logrotate.d/nginx
./etc/nginx
./etc/nginx/nginx.conf
./etc/default/nginx
./etc/systemd/system/multi-user.target.wants/nginx.service
 
I wonder, if for security reasons, it won't bind nginx to a non private address due to this definition of private address ranges addresses:
192.168.0.0/16 0;
172.16.0.0/12 0;
10.0.0.0/8 0;
127.0.0.1 0;
::0/0 0;

I have not yet connected an internal network yet since we have phones on a separate vlan to which computers have no access, but I can always try connecting to our data network for the moment and see if nginx will bind to that
 
Trying to start nginx gives this:
root@voice:~# systemctl status nginx.service
× nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Mon 2023-11-27 22:16:01 GMT; 6s ago
Docs: man:nginx(8)
Process: 77996 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
CPU: 18ms

Nov 27 22:16:01 voice systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Nov 27 22:16:01 voice nginx[77996]: 2023/11/27 22:16:01 [warn] 77996#77996: duplicate network "::0/0", value: "0", old value: "1" in /etc/nginx/sites-enabled/3cxpbx:16
Nov 27 22:16:01 voice nginx[77996]: 2023/11/27 22:16:01 [emerg] 77996#77996: SSL_CTX_use_PrivateKey("/var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-key.>
Nov 27 22:16:01 voice nginx[77996]: nginx: configuration file /etc/nginx/nginx.conf test failed
Nov 27 22:16:01 voice systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE
Nov 27 22:16:01 voice systemd[1]: nginx.service: Failed with result 'exit-code'.
Nov 27 22:16:01 voice systemd[1]: Failed to start nginx.service - A high performance web server and a reverse proxy server.
 
Did you edit the nginx confg file?
this line looks wrong:
SSL_CTX_use_PrivateKey("/var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-key.>
It should be using a file that ends in .pem, like: var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-key.pem

Regardless, it's your nginx config that is broken - so I don't understand how that happened unless you manually edited it.
 
No, I didn't edit the nginx config file. These are the lines relating to the commercial certificate directly from the config file:
ssl_certificate /var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-crt.pem;
ssl_certificate_key /var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-key.pem;
and they look OK, it is just the debug log that seems to be missing the .pem

I wonder why it is saying that ::0/0 0; is a duplicate? I can't see another line similar to this in the config
 
msutherland25 said:
No, I didn't edit the nginx config file. These are the lines relating to the commercial certificate directly from the config file:
ssl_certificate /var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-crt.pem;
ssl_certificate_key /var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-key.pem;
and they look OK, it is just the debug log that seems to be missing the .pem

I wonder why it is saying that ::0/0 0; is a duplicate? I can't see another line similar to this in the config
Click to expand...
The 0/0 is just a warning, the nginx crashing is due to (per the log shown above) the cert issue

What's the output of
Code: 
nginx -t
?
It should be something like:
1701145530707.png
 
root@voice:/etc/network# nginx -t
2023/11/28 15:38:48 [warn] 99458#99458: duplicate network "::0/0", value: "0", old value: "1" in /etc/nginx/sites-enabled/3cxpbx:16
2023/11/28 15:38:48 [emerg] 99458#99458: SSL_CTX_use_PrivateKey("/var/lib/3cxpbx/Bin/nginx/conf/Instance1/voice.ukgastech.co.uk-key.pem") failed (SSL: error:05800074:x509 certificate routines::key values mismatch)
nginx: configuration file /etc/nginx/nginx.conf test failed
 
When going through the initial setup it only required two files. So I created one text file that had the root, intermediate and actual certificate and the other file contained the private key. It seemed quite happy to accept these, but clearly it is not really happy. What format would be correct please?
 
msutherland25 said:
When going through the initial setup it only required two files. So I created one text file that had the root, intermediate and actual certificate and the other file contained the private key. It seemed quite happy to accept these, but clearly it is not really happy. What format would be correct please?
Click to expand...
Usually the setup wizard asks for a PFX file, it actually let you submit a key and crt file? Are they formatted correctly? Is the key file encrypted? Is it the right key file for this cert at all (the error "key values mismatch" indicates it is not).

See my post here https://www.3cx.com/community/threads/update-renew-certificate.77468/#post-356117 that talks about replacing a cert.

Something in your cert setup (specifically the key file) is hosed.
 
The wizard accepted a pem or pfx or crt file I believe and nothing suggested anything was wrong at the time although clearly it is not happy. My initial problems with 3CX is that it did not help with generating a private key at all and then creating a CSR. I did this with openssl manually on the pbx. Globalsign send me the cert in an email which I save into a text file. There seems to be little guidance on what order to put the root, intermediate and actual certificate in the text file. I'll have a look at your post but do get confused between all these different formats! Is the text file with entries such as -----BEGIN CERTIFICATE----- a pem file or a pfx file etc?
 
-----BEGIN CERTIFICATE---- indicates a cert file, not a key file. pem is an encoding option.

If you are unfamiliar with cert generation, this tool can generate and export your certs for you on any windows machine in both formats. You don't have to use digi to sign the certs, you can use the tool with any CA.

https://www.digicert.com/support/tools/certificate-utility-for-windows
 
  • Like
Reactions: N_G
Thank you SweetAction, I really appreciate your help. I tried that free tool from digicert but it couldn't find the private key and frankly I gave up trying to work out how to get a private key into Windows anyway (I'm not a Windows fan!). I finally reversed the order of the certificates (root, intermediate, cert) and all was fine. Netstat now shows that nginx is now listending, so all good. Thank you again
 
  • Like
Reactions: N_G
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
111,974
Messages
590,081
Members
164,899
Latest member
mazet
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom