Solved Juniper Firewall Config

[Phil George]

Hi - We have enabled firewall rules for our 3CX server, however since doing this the clients won't work on smartphones when outside of the network. Can anyone advise what ports we need to have open to allow them to connect?

 

[Saqqara]

All the ports are here - https://www.3cx.com/docs/manual/firewall-router-configuration/

More info that may help https://www.3cx.com/support/firewall-configuration/

When you run the firewall test, does it fail.

 

[Phil George]

Thanks, I hadn't found that first page before. Will try that now.

It does fail yes, I haven't tried it since we made some further changes so will look to do that.

 

[Phil George]

Just a further update on this, we added the ports but the smartphone client still isn't connecting. I presume it is to do with 5060, but if we open that we then see a lot of port scanning. Can anyone advise? Thanks

 

[sip.bg]

May be you can create a white access list with sites / providers which can access your PBX at port 5060. If you are not using such, you may disable port forwarding for port 5060.

 

[lneblett]

Its the nature of the game...unfortunately. As 5060 is a known standard port, it is one that is attacked frequently. If possible, set rules that only allow the items you want to be able to traverse....or.... you can use the 3CX client tunnel.

 

[YiannisH_3CX]

3CX clients outside of the network should be configured to use the tunnel which is port 5090. If you are having issues with clients this is the first port to check.

 

[Phil George]

Thanks Yiannish. So I have now got the firewall check from within 3CX working on everything apart from port 5060, which still fails. Port 5090 is already open to the internet on TCP and UDP and we still get the timeout error when trying to connect the client. What else can I try?

 

[YiannisH_3CX]

Are you using a 3CX FQDN or your own? Does that resolve correctly to your public IP?

 

[Phil George]

We are using the full 3CX FQDN, yes and it does resolve to our public IP if I ping from within our network. The thing is if we disable the firewall rule then it connects, so it must be a single port that is being blocked somewhere. It is just proving difficult trying to find that.

 

[Phil George]

Have now resolved this. For anyone else suffering the same issue, port 5001 needs to be open to the internet not just 3CX IPs.

 

[YiannisH_3CX]

Glad to hear the issue has been resolved and thank you for updating the thread with your solution