Own Public IP Blacklisted

[StephenN]

Lemme give you a little background.

The goal here is to get the 3cx mobile app working but not have our public IP blacklisted everyday with the error of "Blocked for too many failed authentications".

We have a 3cx system where multiple sites are connected. When the public IP of one site is blacklisted it only affects one site, which is good but its an everyday thing. We have the anti hacking set to 25 attempts blocks them out for a little, then another 25 attempts longer, then blocks it for a day after another 25 attempts which means everyday the phones won't work until we unblock it and the customer we manage is very frustrated so we just blocked external access and that fixed it, but made the mobile app not work.

We have a firewall rule to allow external access.

1. When it was allowed then we had external access and we had access to the phone system externally, but this allowed for hackers to attempt to login which blacklisted our own public IP. When this was blacklisted inbound calls didn't work at all. Also when this was allowed the 3cx mobile app worked (which we want).
2. When we disable the firewall rule we were only able to access the system internally which was the fix for the IP being blacklisted everyday, but the 3cx mobile app no longer worked. Trying to scan the QR code says the provisioning file couldn't be reached. Somebody with the app said it worked internally but when she left the office it no longer did.

My questions are:

1. How do I get the 3cx mobile app to work with the firewall rule disabled
2. If I have to have the firewall rule enabled for external access then how do I prevent the IP getting blocked for too many failed authentications? (I can't blacklist their public IP cause the phones wont work if I do and I've tried whitelisting).

Any help would be much appreciated.

Thank you

 

[Saqqara]

Not sure why your own ip address is being listed, normally 3cx will blacklist the wan IP address of where the attack is coming from.

you could always whitelist the ip of the connected sites

you need to look at the firewall logs and see where the traffic is coming from.

the 3cx app requires the tunnel 5090 (port 5090 udp and tcp) and https port open, without this it will not work. https://www.3cx.com/docs/manual/firewall-router-configuration/

 

[AWS2P]

5001 or 443 (depends on what you choose during initial install) and 5090 are the ports needed only for App to work outside office.
On all my Pbxs I decrease to 3 login attempts before blacklisting and never got any problem. Rarely users are mistaking with webclient password and they get blacklisted themself but this is their personal home IP, not the one from PBX.

 

[nub]

What is your internal route to 3cx? when you ping fqdn.3cx.us what is the reply from an internal ip or the public ip?

I like what aws2p said about only needing 5001 and 5090.

 

[craigreilly]

My firewall rules only allow traffic from the VOIP Providers on port 5060.
The tunnel is open for remote softphones to work. Ensure the extension is block external, but allow tunnel.

 

[SteveITS]

allowed for hackers to attempt to login which blacklisted our own public IP

I don't really get how this would happen...are you running some sort of reverse proxy so remote hackers would be seen as connecting from your router's IP?

I've seen where people connect to fqdn.3cx.us:5001 instead of fqdn.3cx.us:5001/webclient, try to log in to the admin portal by mistake, and get blacklisted.

 

[craigreilly]

I don't really get how this would happen...are you running some sort of reverse proxy so remote hackers would be seen as connecting from your router's IP?

I've seen where people connect to fqdn.3cx.us:5001 instead of fqdn.3cx.us:5001/webclient, try to log in to the admin portal by mistake, and get blacklisted.

A very good reason the webclient should use just the fqdn site and the admin side should use a different URL (ie: /3cxadmin).
Can we assume the 3cx Server is in the cloud here since his public IP is getting blacklisted. I do not see any mention of this however. There are subtle clues that it is in 1 of the offices.

 

[StephenN]

5001 or 443 (depends on what you choose during initial install) and 5090 are the ports needed only for App to work outside office.
On all my Pbxs I decrease to 3 login attempts before blacklisting and never got any problem. Rarely users are mistaking with webclient password and they get blacklisted themself but this is their personal home IP, not the one from PBX.

With 5001 open that allows anyone to put in our public IP with the 5001 port and can try and log in. We don't want that. We don't want the web address to work to try to login, only the mobile app. Is there a way around this?

 

[StephenN]

Not sure why your own ip address is being listed, normally 3cx will blacklist the wan IP address of where the attack is coming from.

you could always whitelist the ip of the connected sites

you need to look at the firewall logs and see where the traffic is coming from.

the 3cx app requires the tunnel 5090 (port 5090 udp and tcp) and https port open, without this it will not work. https://www.3cx.com/docs/manual/firewall-router-configuration/

My fear of whitelisting their public IP then it still allows external access for anyone to put in the public IP and try to log in.

 

[StephenN]

A very good reason the webclient should use just the fqdn site and the admin side should use a different URL (ie: /3cxadmin).
Can we assume the 3cx Server is in the cloud here since his public IP is getting blacklisted. I do not see any mention of this however. There are subtle clues that it is in 1 of the offices.

If we just switch to fqdn, what if someone gets a hold of that fqdn. Whats stopping them from brute forcing logins till they get in? We want to only be able to access the phone system internally but somehow get the mobile app to work. If that isn't possible then we will just have to accept it. I tried allowing just 5090 udp and tcp on the firewall but that didn't work. Allowing 5001 I am able to access the phone system from the web browser which is what we are trying to prevent.

 

[Saqqara]

With 5001 open that allows anyone to put in our public IP with the 5001 port and can try and log in. We don't want that. We don't want the web address to work to try to login, only the mobile app. Is there a way around this?

the https port is required to provision the phone, without it the phone will not get it configuration. It is also used for presence and 3cx address book,

the tunnel port 5090, is just used for voip traffic

I would not worry about having then https port open, the hacking system within 3cx is good at blocking attempted hacks. https://www.3cx.com/blog/voip-howto/call-fraud/

With increase in home working, every 3cx system will have this port open.

 

[cobaltit]

If we just switch to fqdn, what if someone gets a hold of that fqdn. Whats stopping them from brute forcing logins till they get in? We want to only be able to access the phone system internally but somehow get the mobile app to work. If that isn't possible then we will just have to accept it. I tried allowing just 5090 udp and tcp on the firewall but that didn't work. Allowing 5001 I am able to access the phone system from the web browser which is what we are trying to prevent.

The anti-hacking is on by default. The Global 3CX IP Blacklist is optional but recommended.

 

[SteveITS]

I'm still confused about the setup. Is the 3CX system in your office or hosted elsewhere? And it is your office IP that is being blacklisted? If hosted elsewhere, you can allow only your office to log in to the Management Console by adding its IP to Settings/Security Settings/Console Restrictions, and checking "Allow Access from specific IP Addresses." That doesn't restrict the web client, since that is generally accessible from everywhere so users can log in. If nothing else you can allow your office IP as an Allow entry under Security/IP Blacklist.

Also it sounds to me like your issue is not really "don't block the IP" but figuring out why the mobile client is triggering blocks at all? Why do you think any block is due to the mobile client, are there logs indicating lots of failed authentications? It's not particularly easy to fail auth, I'd think...scan the QR code and you're set up. I'm not even sure how to test fail a login, offhand.

 

[SteveITS]

See thread https://www.3cx.com/community/threads/ip-blacklist-allow.73393/ ?