Is it possible to host multiple 3CX installs behind a single WAN IP? For instance, a multi-tenant building with 1 WAN IP, multiple customers with multiple PBXs.
You used to be able to configure all of the ports in the multi-tenant version (V14 and previous). I'm not sure how you would handle that. While port 5060 can be changed, there are many other ports that would have to be separated and routed to each instance.
As Leejor said, you can do this with the v14 multi tenanted version but this is now EOL and 3CX will offer no support when using v14 of whatever version.
Single public IP per 3CX instance is required. The public IP address is bound to the public FQDN, SSL Certificate and 3CX licence, the only time this differs is when you have the Enterprise licence (which is a single licence key which can authenticate from 2 locations).
You could go the route of cloud hosting which will eliminate the problem of multiple PBX' on the same external IP. Google cloud is really inexpensive for what you get. Using an SBC for each tenant might resolve the port issues as well. You may have to reconfigure the main port (5060) to match the PBX and SBC for each tenant but I would test first. You might also have to change the default port of the SBC (5090) for the additional SBC's. Again - TEST FIRST. This is theory 101.
$25/month, I consider that a lot, cuts deep into margins.
The SBC doesn't solve situations where an on-prem system is necessary for latency. Some sites have poor latency and adding the extra leg to some cloud hosting provider can make the difference between comfort and frustration.
Now $25/month for a few extra IP addresses is better than a bunch of cloud instances, but that's not really the point.
I'm hoping to be able to configure a different port for 3CX, say 5080, and go from their. A reverse proxy or decent firewall can send the web packets the right way.
Also, what about licensing? What happens if 3CX sees 2 PBX's on the same WAN address?
I agree with Leejor - see my points about how the 3CX licencing works in v15/15.5 now (FQDN, public IP address etc).
The only way you can achieve this is with the v14 multitennant which is EOL and unsupported now.
The only other way I know partners getting around situations where they want multitennant (and it's not a full proof solution) is by having one large hosted deployment on v15.5 and splitting/segregating each tenant by extension groups (As you can block them from seeing one another).
And having a separate trunk for each group/queue/ring group.