No Audio When Connected to VPN

[MKRS-Admin]

Hello,

I suspect I am missing a firewall rule/policy, but haven't been able to figure which policy that might be.

I've familiarized myself with https://www.3cx.com/docs/manual/firewall-router-configuration/
I have followed the FortiGate setup in https://www.3cx.com/docs/fortigate-firewall-configuration/

Calls, whether from cell-phones, computers or IP phones all work in the office.
Running the 3CX firewall test passes with no errors - Is there a similar test a user can run on their machine?

However, when a user is working remotely and connected to the VPN, calls connect but there is no audio for outgoing and incoming calls.
If a user records the call, incoming audio is audible in the recording.

Any advice would be greatly appreciated.
Thanks for your time!

Setup:
Fortigate-100E running v7.0.0
On-premise 3CX running v18.0
User Machine: Win10 running the 3CX Desktop Client

Policies: (NAT disabled)
SSL-VPN > LAN = allows VPN users to connect to the local 3CX server over ports 80, 443, 5060, 5090, 9000-10999
SSL-VPN > WAN = allow VPN users out over ports 80, 443

Attempted fixes:
I have tried creating the following rules but neither worked, nor was any traffic routed over them.
LAN > SSL-VPN = allows 3CX server to connect to VPN Users over ports 80, 443, 5060, 5090, 9000-10999
SSL-VPN > WAN = allow VPN users out over ports 80, 443, 5060, 5090, 9000-10999

 

[Evolute IT]

You need SSL-VPN > LAN, not WAN.

 

[Saqqara]

Try this steps.

Close the 3CX down
Start the VPN client
Open 3cx up,

Do you actually need the vpn as 3cx traffic is already encrypted. Understand if the vpn is used to access internal services. Can you add the 3cx server internal IP / external fqdn address to the vpn software so it does not route traffic down the vpn.

Note ; 3CX applications only use the 3cx tunnel port - 5090 and 3cx https port 443

 

[Charles_3CX]

What are you using in the remote sites? 3cx apps or IP phones, since you are connecting in through VPN then connections are to the local Ip of the PBX, the audio ports are not going to be in the 9000> range, and depending on what you are using will determine the required ports. Suggestion, allow all UDP traffic through the VPN and check.

 

[MKRS-Admin]

@Charles_3CX: Thanks for the reply, you are the man! I was only allowing TCP traffic on those ports. Allowing UDP fixed the issue.
We are using 3CX desktop client application. I gathered from Saqqara's comment above we only need ports 5090 and 443 open for the client?

@ConceptsWeb: The SSL-VPN > LAN rule is what I have, in place. The SSL-VPN > LAN was a test/troubleshooting rule.

@Saqqara: I tried opening the 3CX application after connecting to the VPN, same results. I appreciate the information about the 3CX application only using ports 5090 and 443, I'll simplify the rules to just include those two ports.

Due to CMMC 2.0 and NIST SP 800-171 compliance, we can not do any split tunnel routing.

 

[Charles_3CX]

We are using 3CX desktop client application. I gathered from Saqqara's comment above we only need ports 5090 and 443 open for the client?

Actually, no, the 3cx desktop app is WerRTC based and uses the HTTPS port 443 TCP if using HTTPS and able to reach the PBX using the FQDN or port 80 TCP internally via HTTP (if your HTTPS port is 443 and 80 for HTTP). Audio ports are again UDP. They do not use the 3cx tunnel.

 

[vpntested.com]

You can refer to the following articles hope to help you