Ports not reachable in 3cx v16

[Yellow_Flash]

Hi,

we are setting up a new 3cx install on debian in the remote location.
First time configuration has been completed after which I've opened the ports mentioned below.
5090 (inbound, UDP and TCP)
443 or 5001 (inbound, TCP)
443 (outbound, TCP)
5060 (inbound, UDP and TCP)
5061 (inbound, TCP)
9000-10999 (inbound, UDP)
2528


I've done a firewall check after this and the error I received is:

resolving 'stun-eu.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX SIP Server... failed (How to resolve?)
stopping service... done
detecting SIP ALG... failed (How to resolve?)
testing port 5060... not reachable (How to resolve?)
starting service... done
testing 3CX Tunneling Proxy... failed (How to resolve?)
stopping service... done
testing port 5090... not reachable (How to resolve?)
starting service... done
testing 3CX Media Server... failed (How to resolve?)
stopping service... done
testing ports [9000..9398]... failed (How to resolve?)
testing port 9000... not reachable (How to resolve?)
testing port 9002... not reachable (How to resolve?)
testing port 9004... not reachable (How to resolve?)
testing port 9006... not reachable (How to resolve?)
testing port 9008... not reachable (How to resolve?)
testing port 9010... not reachable (How to resolve?)
testing port 9012... not reachable (How to resolve?)
testing port 9014... not reachable (How to resolve?)
testing port 9016... not reachable (How to resolve?)
testing port 9018... not reachable (How to resolve?)

This error goes on till the firewall checker completes every port and every single port is "not reachable".
I'm also not getting why ports 5060 and 5090 are giving the error as I've opened these on the firewall.

Can someone please let me know what else has to be done? I'm setting up a new 3cx instance for the first time and my knowledge in this field is very limited.
Kindly let me know what more has to be done.


Thank you.

 

[Saqqara]

What firewall do you have ?

Have you disabled sip allg on the firewall

 

[JohnS_3CX]

Hello

It seems that the ports are not open as expected in this case.

How is the PBX connected? Is it single or dual NIC? VM or bare metal?
The checker cannot reach our servers to complete the test.

 

[Yellow_Flash]

@Saqqara sip alg isnt disabled I believe.

 

[Saqqara]

@Saqqara sip alg isnt disabled I believe.

This is the first step, disable sip alg and rerun the firewall test

 

[Yellow_Flash]

This is the first step, disable sip alg and rerun the firewall test

Sure thing.
I just want to know one more thing.
When they say Port has been opened, is it the same as Port forwarding?

 

[Saqqara]

When they say Port has been opened, is it the same as Port forwarding?

Yes,

 

[JohnS_3CX]

It could mean a couple of things depending on the context. For example if I dont block outgoing traffic to port 6000 then it could be said that the port is open.

Forwarding will imply that the the internal port will always match the external port you choose. We recommend to use full cone NAT for this reason, the port will match 1:1 such that your inernal port 5060 will match to the external public IP again at 5060

SIP ALG might modify the ports or the packets so it should be disabled to avoid unexpected behavior.

 

[Yellow_Flash]

It could mean a couple of things depending on the context. For example if I dont block outgoing traffic to port 6000 then it could be said that the port is open.

Forwarding will imply that the the internal port will always match the external port you choose. We recommend to use full cone NAT for this reason, the port will match 1:1 such that your inernal port 5060 will match to the external public IP again at 5060

SIP ALG might modify the ports or the packets so it should be disabled to avoid unexpected behavior.

Okay, thank you for that explanation.

It is a Network Engineer who handles the firewall.
I gave him the list of ports that has to be opened.
He must have done port forwarding but not the full cone NAT.
I believe I should ask him do a full cone NAT for all these ports ?

5090 (inbound, UDP and TCP)
443 or 5001 (inbound, TCP)
443 (outbound, TCP)
5060 (inbound, UDP and TCP)
5061 (inbound, TCP)
9000-10999 (inbound, UDP)
2528

Or is it enough for the ports from 9000 to 10999?

Last time I remember we running a command,
ip nat inside source static udp 192.168.2.200 (Port number) interface FastEthernet0/1 (Port number)

I believe we have to do something similar?
Thank you.

 

[JohnS_3CX]

Provided that you kept the default ports during the 3CX installation, this is the list you need to give to your engineer: https://www.3cx.com/docs/ports/

Where is the PBX installed? Did you use the 3CX Debian iso ? This would take care of things as it comes preconfigured

 

[Yellow_Flash]

Provided that you kept the default ports during the 3CX installation, this is the list you need to give to your engineer: https://www.3cx.com/docs/ports/

Where is the PBX installed? Did you use the 3CX Debian iso ? This would take care of things as it comes preconfigured

Yes, the default ports were kept during the installation.
Do you mean whether the 3cx is Vm or baremetal install? It is a bare-metal install.
It is installed in our recovery site.
Also, I did use the 3cx Debian iso that 3cx provides.

 

[JohnS_3CX]

Great so the ISO will build your static routes too during installation.

Does your machine have dual NICs or single?

 

[Yellow_Flash]

Great so the ISO will build your static routes too during installation.

Does your machine have dual NICs or single?

Can you please give more info on what static routes you are talking about?

Also, the machine has single NIC.

 

[Saqqara]

Also, I did use the 3cx Debian iso that 3cx provides.

As you used the 3CX Debian ISO image, there is nothing to do on the debian side as it taken care off during the installation

You have to resolve the issues on the firewall.

 

[Yellow_Flash]

As you used the 3CX Debian ISO image, there is nothing to do on the debian side as it taken care off during the installation

You have to resolve the issues on the firewall.

Okay, thank you.

 

[Yellow_Flash]

I went through the build history document and I see this,

• External Port Range Change: 9000-10999 [UDP]
• Internal Port Range Change: 7000-8499 [UDP]

Do I have to open these ports too?

 

[Saqqara]

I went through the build history document and I see this,

• External Port Range Change: 9000-10999 [UDP]
• Internal Port Range Change: 7000-8499 [UDP]

Do I have to open these ports too?

Only the external ports, which you do on the firewall.

The internal ports are done for you, as part of the 3CX debian installation.

 

[Yellow_Flash]

Okay, I will have a check on everything and update