Need Help Configuring Firewall

[Jnicks]

Hello,

Using Debian IPTABLES to configure my firewall.

When I run the firewall check, I get a full cone test failed. Am I on the right track here using the following rules, what changes should I make?

#IP Tables Setup
sudo iptables -A INPUT -m state --state INVALID -j REJECT
sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp -s <my_ISP_IP> --dport 22 -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -j REJECT

## 3CX Specific
# Web Interface
sudo iptables -A INPUT -p tcp -s <my_ISP_IP> --dport 5001 -j ACCEPT

# SIP Trunk
sudo iptables -A INPUT -p udp -m iprange --src-range <my_SIP_Tunk_IP_Range> --dport 5060 -j ACCEPT


#3CX Tunnel Protocol Service Listener
sudo iptables -A INPUT -p tcp -s <3cx_server_ip> --dport 5090 -j ACCEPT
sudo iptables -A INPUT -p UDP -s <3cx_server_ip> --dport 5090 -j ACCEPT

#3CX Media Server (RTP) – WAN audio/video/t38 streams
sudo iptables -A INPUT -p udp -s <3cx_server_ip> -m multiport --dports 9000:10999 -j ACCEPT

 

[eddv123]

Have you seen this guide yet ? It should provide full instructions on the process:
https://www.3cx.com/docs/manual/firewall-router-configuration/

Have you a physical firewall in front of the server also or are you going direct ?

 

[YiannisH_3CX]

Hello @Jnicks

Why not use the 3CX Debian iso that includes all necessary IP Table rules?

 

[TBWD]

I think you may need to open and forward ports from your router firewall as well, you can disable iptables completely but if your hardware firewall is not open and forwarding, the test will fail.

 

[Jnicks]

Is it safe to disable iptables all together and just use the firewall provided by my hosting provider? I am sort of hesitant to disable iptables, but if the hosting firewall is good enough!

 

[Marari]

Is it safe to disable iptables all together and just use the firewall provided by my hosting provider? I am sort of hesitant to disable iptables, but if the hosting firewall is good enough!

Personally, I would NEVER disable an internal firewall (be it iptables or windows firewall or whatever) regardless of the external NGFW / router / etc.

If you used the 3CX debian ISO, the iptables entries would already be there.
If you didn't, you'll have to put the entries in manually. It's a trade off of convenience vs control.

In either scenario, you still need to open the proper ports in the hosting provider's "firewall". You need to make sure that traffic from the outside world (preferably refined to the addresses/subnets that need it) gets to your PBX. That is done through port forwarding.

 

[Jnicks]

Thanks. I have opened port 5060, and white listed my SIP trunk IP range, my IP and the servers IP. Still getting a full cone error. I do want to limit it to IP, what else am I missing?

 

[Marari]

what else am I missing?

Probably a bit of late night reading.

I'd start here:

https://www.3cx.com/docs/manual/firewall-router-configuration/

There are more ports than 5060 that need to be opened.

The main thing you want to take away is this:

"The firewall checker does not lie."

So basically, you need to check a few things.
1. Are the ports being forwarded as is? (i.e. port 5060 is being forwarded to 5060 on the PBX and not being forwarded as some other port number)
2. Is SIP ALG disabled? (It should be)
3. Are all of the media ports properly forwarding? (9000-10999)

Next:
You will always get a firewall checker failure if the checker cannot talk to the 3CX stun servers. For whatever reason, you cannot shut down port 5060 to all but the VOIP provider when running the firewall test or it will fail. After the firewall test is completed successfully, you can then shut down 5060 to everything but the VOIP provider if you wish.

But start at the firewall checker. You're not good to proceed to more troubleshooting until you have an all-green result.

Without knowing a bit more about your environment/host platform, I really can't offer you any more than generic info.

 

[Jnicks]

Ah ok, So I disabled my hosts firewall rules, ran the firewall checker and it worked! Now I am going to add restrictions back into my hosts firewall rules. I think thats it?

 

[TBWD]

only if you can set all forwarding rules from the firewall, if you dont have access to do this I would not disable iptables

 

[YiannisH_3CX]

Ah ok, So I disabled my hosts firewall rules, ran the firewall checker and it worked! Now I am going to add restrictions back into my hosts firewall rules. I think thats it?

If you are able to pass the firewall checker then you can apply the restrictions to only allow trusted IPs. If you face any issues you can always go back to the configuration that allows the firewall checker to pass so you can troubleshoot.

 

[9009]

I just installed the 3CX on a Windows machine and have all ports forwarded correctly, but the Firewall failed. Everything passed except the following:

testing 3CX SIP Server... failed (How to resolve?)

• stopping service... done
• detecting SIP ALG... not detected
• testing port 5060... used by '3CXPhoneSystem':1932 (How to resolve?)

 

[TBWD]

Completely disable windows firewall, and use your router firewall only.

 

[Marari]

Completely disable windows firewall, and use your router firewall only.

This is awful advice. Sorry.

"Disabling Windows Firewall increases the attack surface of Windows Server. Any infected machine that gets access to your corporate intranet can potentially make a connection to an unprotected server and compromise it by exposing a vulnerability in a Windows service or 3rd-party application. Windows Firewall is also useful in defending against denial of service attacks, which bombard a server with network traffic in an attempt to crash it or simply make it unavailable to the rest of the network."

from https://www.petri.com/dont-disable-firewall-windows-server and countless other security sites.

Having said that, @9009 , you may want to start your own thread rather than hijacking someone else's, and please do a search. You may find that your question has been answered in the past.

If all else fails, please try this:

Reboot the server. Reboot the router/gateway/external firewall.

Configure the windows firewall with the appropriate rules:
https://www.3cx.com/docs/manual/firewall-router-configuration/ (please note the windows firewall specific section).