Outbound firewall requirements.

[garbwell]

I am going to be installing 3cx on a windows based machine using sip.us sip trunks. I will not be having any remote extensions or bridges. The system will be used very basically. My network engineer is requesting what outbound access the PBX will need access to. According to 3cx documentation on its watch guard firewall example, it says to allow all outbound traffic which according to my engineer will not be ok due to PCI compliance. From my knowledge the only outside access the phone system will need would be access to the voip provider and 3cx for updates. Is this accurate or are there other outside sources the phone system accesses?

 

[Evolute IT]

The system needs full Internet access in order to use it.

- Updates for PBX, phones and templates
- WebMeeting sync
- Activation servers (your system reverts back to free if not reachable)

And probably more that we forget.

 

[garbwell]

A complete list would be very helpful for me if anyone knows.

 

[cobaltit]

If you are looking to be PCI compliant then the PBX shouldn't be inside your CDE so you wouldn't need to worry about restricting outbound traffic from it.

 

[garbwell]

I think my engineer wants to go a step further. Even in a parameter or DMZ network, he wants to lock down outbound traffic to only the resources the PBX absolutely needs.

 

[SteveITS]

Will there be people connecting from mobile apps or web browsers outside the office?

 

[garbwell]

No

 

[cobaltit]

So if you have a real firewall you can simply stand up 3CX, deny all and then check the logs. But pretty much everything you need is right here:

https://www.3cx.com/docs/manual/firewall-router-configuration/

 

[garbwell]

That mainly is all inbound forwarding. We are using a watchguard and in the example for config, it says to allow all outbound access. We need to limit that to only outbound resources 3cx requires. Nothing more.

 

[cobaltit]

Mainly is not only. There are outbound requirements listed there as well. There's also some on this page:

https://www.3cx.com/docs/manual/phone-system-installation-windows/#h.5hoy5wwhhk5c

Or again, simple look at the firewall logs to see where traffic is going. If your network engineer is actually an engineer, it really shouldn't be too difficult.

 

[garbwell]

Thanks for your input but the environment isn't going to allow a trial and error style approach. I work in a large corporate environment where the engineer is only responsible for the network. He knows nothing about 3cx as it is not his responsibility, his only concern is the network requirements. The link you provided does give me some information I am looking for but not all so thank you for that also. I created a ticket with 3cx and got mostly what I was looking for. Thanks to all for their input.

 

[_DJ_]

If you would like to post those results here, that would be awesome

 

[cobaltit]

Err..you don't have a test environment for a large corporate environment? And the engineer doesn't need to know anything about 3CX. All he needs to know is what traffic is trying to make it out from 3CX and then you two can put your heads together to decide whether you want to allow it or not. But as long as you got what you need I guess you are all set. It would be nice if 3CX posted it on the ports/firewall page though.

@JohnS_3CX Can you see about making that happen?