We have a 3CX system running on-prem on Debian and the IPtables firewall is blocking our HTTP and HTTPS ports (4400, 4433). The rules do allow inbound on 80 and 443. This wasn't an issue for the past year until we upgraded from v16 ->v18.0.0.1880 about a week ago and then rebooted. I can regain access to the web UI by adjusting the rules themselves, but this is looking like a bug in 3CX.
root@PBX0:~# iptables-save
# Generated by iptables-save v1.6.0 on Wed Sep 29 12:31:04 2021
*filter
:INPUT DROP [190:11400]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [116324:30219862]
:ICMPFLOOD - [0:0]
:SSHBRUTE - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
-A INPUT -d 224.0.1.75/32 -j ACCEPT
-A INPUT -m addrtype --dst-type BROADCAST -j DROP
-A INPUT -m addrtype --dst-type MULTICAST -j DROP
-A INPUT -m addrtype --dst-type ANYCAST -j DROP
-A INPUT -d 224.0.0.0/4 -j DROP
-A INPUT -p tcp -m multiport --dports 80,443,5000,5001,5015,5060,5061,5090 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m multiport --dports 69,5060,5090,7000:10999 -j ACCEPT
-A INPUT -p udp -m multiport --dports 137,138 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 139,445 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j SSHBRUTE
-A INPUT -p icmp -m icmp --icmp-type 0 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ICMPFLOOD
-A INPUT -p udp -m multiport --dports 135,445 -j DROP
-A INPUT -p udp -m udp --dport 137:139 -j DROP
-A INPUT -p udp -m udp --sport 137 --dport 1024:65535 -j DROP
-A INPUT -p tcp -m multiport --dports 135,139,445 -j DROP
-A INPUT -p udp -m udp --dport 1900 -j DROP
-A INPUT -p udp -m udp --sport 53 -j DROP
-A INPUT -p tcp -m tcp --dport 113 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
-A INPUT -m limit --limit 1/sec --limit-burst 100 -j LOG --log-prefix "iptables[DOS]: "
-A ICMPFLOOD -m recent --set --name ICMP --mask 255.255.255.255 --rsource
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --rttl --name ICMP --mask 255.255.255.255 --rsource -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "iptables[ICMP-flood]: "
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --rttl --name ICMP --mask 255.255.255.255 --rsource -j DROP
-A ICMPFLOOD -j ACCEPT
-A SSHBRUTE -m recent --set --name SSH --mask 255.255.255.255 --rsource
-A SSHBRUTE -m recent --update --seconds 300 --hitcount 10 --name SSH --mask 255.255.255.255 --rsource -m limit --limit 1/sec --limit-burst 100 -j LOG --log-prefix "iptables[SSH-brute]: "
-A SSHBRUTE -m recent --update --seconds 300 --hitcount 10 --name SSH --mask 255.255.255.255 --rsource -j DROP
-A SSHBRUTE -j ACCEPT
COMMIT
# Completed on Wed Sep 29 12:31:04 2021
