I'm replacing a pfSense router with a Mikrotik RB5009 router.
I have a single dynamic IP from my ISP. My lan is 192.168.0.0/21 and the 3CX server is in a DMZ at 10.1.1.20.
I disabled SLP ALG service port as per the 3CX instructions, and issued the commands below (also from the 3CX instructions).
Firewall checker fails to resolve any STUN. All checks passed, and system worked as intended with the pfSense router.
ether1 is my WAN interface
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5060 protocol=udp dst-port=5060 comment="3CX SIP UDP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5060 protocol=tcp dst-port=5060 comment="3CX SIP TCP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5061 protocol=tcp dst-port=5061 comment="3CX SIP TLS"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=9000-10999 protocol=udp dst-port=9000-10999 comment="3CX Media UDP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5090 protocol=tcp dst-port=5090 comment="3CX Tunnel TCP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5090 protocol=udp dst-port=5090 comment="3CX Tunnel UDP"
ip firewall filter add chain=input action=accept connection-state=established
ip firewall filter add chain=input action=accept connection-state=related
ip firewall filter add chain=forward action=accept connection-state=established
ip firewall filter add chain=forward action=accept connection-state=related
ip firewall filter add chain=forward action=drop connection-state=invalid
ip firewall filter add chain=input action=drop in-interface=ether1
ip firewall nat add chain=srcnat action=masquerade out-interface=ether1
I have a single dynamic IP from my ISP. My lan is 192.168.0.0/21 and the 3CX server is in a DMZ at 10.1.1.20.
I disabled SLP ALG service port as per the 3CX instructions, and issued the commands below (also from the 3CX instructions).
Firewall checker fails to resolve any STUN. All checks passed, and system worked as intended with the pfSense router.
ether1 is my WAN interface
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5060 protocol=udp dst-port=5060 comment="3CX SIP UDP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5060 protocol=tcp dst-port=5060 comment="3CX SIP TCP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5061 protocol=tcp dst-port=5061 comment="3CX SIP TLS"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=9000-10999 protocol=udp dst-port=9000-10999 comment="3CX Media UDP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5090 protocol=tcp dst-port=5090 comment="3CX Tunnel TCP"
ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.1.1.20 to-ports=5090 protocol=udp dst-port=5090 comment="3CX Tunnel UDP"
ip firewall filter add chain=input action=accept connection-state=established
ip firewall filter add chain=input action=accept connection-state=related
ip firewall filter add chain=forward action=accept connection-state=established
ip firewall filter add chain=forward action=accept connection-state=related
ip firewall filter add chain=forward action=drop connection-state=invalid
ip firewall filter add chain=input action=drop in-interface=ether1
ip firewall nat add chain=srcnat action=masquerade out-interface=ether1
