Local Sip port (remote extensions STUN) is replaced by firewall/router

[hasler]

Hello dear community.
We installed a 3CX at our customer's site last week.
It is hosted as a virtual machine at Microsoft Azure.
We don't use SBC for the 5 IP phones and don't want to install it.

Everything is working fine, except that some extensions (Grandstream GXP2135 with the latest firmware) are randomly logging off the PBX.
In the PBX this extension appears "red" and in the phone itself the sip account is correctly registered "green".
By restarting the phone everything will work again for a while.
According to 3CX support, this is because the local sip port of the phone - see table below - is replaced by the firewall/router.

Configured in 3CX PBX for each phone
00 - | Sip local 5065 | RTP local Audio 14000 - 14012
01 - | Sip local 5066 | RTP local Audio 14013 - 14023
02 - | Sip local 5067 | RTP local Audio 14024 - 14035
03 - | Sip local 5068 | RTP local Audio 14036 - 14047
04 - | Sip local 5069 | RTP local Audio 14048 - 14059

According to 3CX support, the phone must register on the local port e.g. 01 with sip:[email protected]:5066 (port preservation)
In the log of the PBX the IP phone is registered with sip:[email protected]:35398.
The X.X.X.X is the public static IP of the customer's Internet connection



The "Barracuda" firewall is managed by another company.
The Grandstream phones are connected and configured on the firewall in the DMZ.
Yesterday the technician configured NAT rules for the individual IP phones:



But these had no effect, the internal SIP port is still replaced by the router / firewall.
Yesterday he tried an outgoing rule - see blue arrow above - but it had the effect that the phones did not register with the PBX anymore.

Do you have a tip or can you help me to solve the problem with the goal that the IP phones communicate with the local port (SIP RTP)?

Thank you very much and have a nice day.

Andreas

 

[Alphabetic]

Is SIP ALG turned off on the router?

Was the phone reprovisioned after you changed the local SIP port in the 3CX EXT Settings.

 

[JohnS_3CX]

Hi Andreas,

You have 2 choices here:

Either set up the firewall correctly to preserve the ports (you will have to spend more time with the technician until they get it right) and this can be done of course, but you will have to consider whether your time is better spent troubleshooting OR install an SBC to save yourself the trouble and bypass the firewall restrictions.

Note: sometimes, you may have to restart your firewall and phones before the "old" ports are forgotten and it allows the new rules to apply.

 

[hasler]

Hi Andreas,

You have 2 choices here:

Either set up the firewall correctly to preserve the ports (you will have to spend more time with the technician until they get it right) and this can be done of course, but you will have to consider whether your time is better spent troubleshooting OR install an SBC to save yourself the trouble and bypass the firewall restrictions.

Note: sometimes, you may have to restart your firewall and phones before the "old" ports are forgotten and it allows the new rules to apply.

Hi John.
I will try to set up the firewall on monday.
Which hardware (I have only 5 ip phones) do you reccomend for the SBC?

Thanks,

Andreas

 

[hasler]

Is SIP ALG turned off on the router?

Was the phone reprovisioned after you changed the local SIP port in the 3CX EXT Settings.

SIP ALG is turned off on the firewall.
I first reprovsioned the phones and after that also rebooted the phones.

Best regards,

Andreas

 

[JohnS_3CX]

I can make some SBC suggestions:

- Raspberry Pi 3B+ (specifically this model only - at least for now) even a used one will be cheap serve you well

- An old PC or laptop that is no longer being used and can be dedicated to SBC

- If you have VM server, you can create a small VM to run the SBC on

- If you have a dedicated server for other jobs (ie file server) you can also create a VM there and install it (it will be isolated from the rest of the server)

Requirements can be found here, the bare minimum requirements should be more than enough for 5 extensions.
https://www.3cx.com/docs/recommended-hardware-specifications-for-3cx/#h.za60f8obhoix
It can be installed on both Windows and Debian/Raspbian

Note: Please avoid installing it on a machine that does other stuff (like a user's desktop PC) so you can be sure it will remain stable 24/7. Debian/Rapsbian is preferable since you can avoid windows and save some resources that can be put to better use.


If you have any further questions I will be glad to assist you