Ports required to connect MCU webmeeting

[angelgomez]

Hello

I need to know what ports need to be opened in the local firewall in order to connect against the webmeeting MCU server. I have seen that port 443 tcp is required for web and ports 40000 to 65535 UDP are required for output audio and video.

Ports 40000 to 65535 UDP must also be allowed to enter the office firewall.

Is there any network schematic or technical document on how 3CX Webmeeting works

Thanks,

 

[LeonidasG_3CX]

You don't typically need to open anything for WebMeeting use as it's very good at network tunneling even in strict firewall conditions. This would need to be done only for extreme network lockdown situations.

If you really want to open some ports on your firewall for WebMeeting, you can do the following:

Office Network:
Whitelist all IP's and add a QoS rule for all IPs returned by the following FQDNs.

• mcu-zone-a.3cx.net
• mcu-zone-b.3cx.net
• mcu-zone-c.3cx.net
• mcu-zone-d.3cx.net
• mcu-zone-e.3cx.net
• mcu-zone-f.3cx.net
• mcu-zone-i.3cx.net
• webmeeting-director.3cx.net

UDP: 48000-65535
TCP: 443


PBX:
Whitelist your PBX's MyPhone port towards all IPs returned by:

• zone-a.3cx.net
• zone-b.3cx.net
• zone-c.3cx.net
• zone-d.3cx.net
• zone-e.3cx.net
• zone-f.3cx.net
• zone-i.3cx.net
• mcu-zone-a.3cx.net
• mcu-zone-b.3cx.net
• mcu-zone-c.3cx.net
• mcu-zone-d.3cx.net
• mcu-zone-e.3cx.net
• mcu-zone-f.3cx.net
• mcu-zone-i.3cx.net
• webmeeting-director.3cx.net

TCP: PBX MyPhone Port - 5001 or 443 typically

**If you plan to use dial-in for WebMeeting, allow RTP UDP ports 10500-10999 from your PBX to be reachable by the IP's returned by the above FQDNs.

 

[angelgomez]

Thanks for the reply.

In this case we have many restrictions on the network. We have opened in the firewall the output of the audio and video ports from 48000 to 65535 UDP against the MCU server assigned for webmeeting. We can connect against the meeting room via the web but once inside a "Reconnecting Media" message appears. We see that the firewall is blocking the response of the MCU server through the 48000-65535 TCP and UDP ports against the local client.

These inbound and outbound ports (48000-65535 TCP and UDP) must be opened in the firewall. Webmeeting uses other ports for the rest of the options (screen sharing, whiteboard, PDF sharing)

It is possible that the chrome or firefox browser encapsulate traffic over https 443 without the ports being closed in and out.

 

[angelgomez]

You don't typically need to open anything for WebMeeting use as it's very good at network tunneling even in strict firewall conditions. This would need to be done only for extreme network lockdown situations.

If you really want to open some ports on your firewall for WebMeeting, you can do the following:

Office Network:
Whitelist all IP's and add a QoS rule for all IPs returned by the following FQDNs.

• mcu-zone-a.3cx.net
• mcu-zone-b.3cx.net
• mcu-zone-c.3cx.net
• mcu-zone-d.3cx.net
• mcu-zone-e.3cx.net
• mcu-zone-f.3cx.net
• mcu-zone-i.3cx.net
• webmeeting-director.3cx.net

UDP: 48000-65535
TCP: 443


PBX:
Whitelist your PBX's MyPhone port towards all IPs returned by:

• zone-a.3cx.net
• zone-b.3cx.net
• zone-c.3cx.net
• zone-d.3cx.net
• zone-e.3cx.net
• zone-f.3cx.net
• zone-i.3cx.net
• mcu-zone-a.3cx.net
• mcu-zone-b.3cx.net
• mcu-zone-c.3cx.net
• mcu-zone-d.3cx.net
• mcu-zone-e.3cx.net
• mcu-zone-f.3cx.net
• mcu-zone-i.3cx.net
• webmeeting-director.3cx.net

TCP: PBX MyPhone Port - 5001 or 443 typically

**If you plan to use dial-in for WebMeeting, allow RTP UDP ports 10500-10999 from your PBX to be reachable by the IP's returned by the above FQDNs.

Hi,

I've done a test connection to a web meeting with Firefox and Chrome. I have seen how it first tries to connect through 48000-65535 UDP ports and the meeting works. By putting a firewall and closing the ports 48000-65535 UDP only connects via https 443 and it still works, this implies some limitation in the meeting when closing the ports.
Are these 48000-65535 UDP ports of entry and exit to the internal network of the company necessary?

 

[LeonidasG_3CX]

The UDP range 48000-65535 is the primary preferred method of connecting to an MCU for transmitting and receiving media. If these are blocked / restricted on the user's firewall, then we use TCP over port 443 via TURN protocol and transmit/receive both media and signaling.

It's suggested that for optimal use that you allow communication to and from 3CX MCUs for the port ranges above.