IP address mismatch

[RayBro]

Hello,
I have been running my 3CX server for some time which is currently at rev 16.0.493. When it was initially set up, our service provider was trying to use a Mikrotik VPN box to no avail. So, we went straight in and assigned the public IP to the NIC on the server. Everything works fine, except I have been a little worried about it being naked and left to the world.
The server is connected to both the lan with a private IP and the WAN with the public IP (2 nics). The phones provision on the lan or the public ip.
I recently purchased a NetGate pFsense firewall appliance and set it up based on the 3CX documentation. On the server, I disabled the nic with the pubilic IP and will only use the lan ip. I also set the gateway on the nic to the pFsense box. I do not have a nat set for the private IP to public.
So, public IP is static and no changes to DNS, public gateway. Once I connect the NetGate box I get an IP address mismatch error on the 3CX console.
After going through the forum it looks like I have 2 choices. Either set the public IP to dynamic and let DNS propagate or reinstall 3CX and restore. I'm not sure setting the public IP to dynamic would do anything since the IP has not changed. It is a static IP. Hoping someone can steer me in the right direction. One question I do have is regarding the forward facing IP address which I cannot change. Should that be the server IP or the IP of the pFsense box. When thing are working {without the NetGate} I have 2 choices, my public and private IP. When I connect the NetGate, I only show the server IP.

 

[YiannisH_3CX]

Hi @RayBro

Try setting the PBX to dynamic and restart all the 3CX services. The PBX should auto detect the public IP (although it has not changed). You also need to make sure that your devices are provisioned using the correct interface and that you have opened all the necessary ports on your pFsense. https://www.3cx.com/docs/ports/
Let us know how it goes.

 

[RayBro]

Thanks Yiannis. I set the IP to dynamic, only allowed my internal NIC to function restarted the services and waited. All the phones registered fine. After an hour or so it was still detecting so I changed the IP to static and put in the public IP. The stun servers and my VOIP provider failed to register. I waited a little longer and the STUN began working, a little later the VOIP provider registered. All is working, inbound, outbound, the 3CX app on my phone connects.
Everything works except the firewall checker.....but the phones work.

• resolving 'stun-us.3cx.com'... done
• resolving 'stun2.3cx.com'... done
• resolving 'stun3.3cx.com'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... failed (How to resolve?)
  • testing port 5060... not reachable (How to resolve?)
  • starting service... done
• testing 3CX Tunneling Proxy... failed (How to resolve?)
  • stopping service... done
  • testing port 5090... not reachable (How to resolve?)
  • starting service... done
• testing 3CX Media Server... failed (How to resolve?)
  • stopping service... done
  • testing ports [9000..9398]... failed

 

[YiannisH_3CX]

Glad to see you were able to update your public IP. Regarding the firewall checker did you open all the required ports?

 

[RayBro]

Firewall is set per documentation. I have 2 static IPs from my ISP. The other IP is used for the rest of our infrastructure, computers, servers, cameras, etc. I have a fortigate on that side which is not configured for 3CX. I am thinking the firewall check is attempting to test on the Fortigate side. I will place the PBX server on a separate Vlan to see if that corrects the firewall check, also to prevent the endpoints from grabbing that gateway since it is unfiltered internet(this is a school). Everything about the PBX is working fine.