Solved ports to be opened on firewall

[itops-care-bears]

hi all, got some questions regarding ports to be opened for voice traffic. refer to the link below. im no voice expert so please execuse any dumb questions.
https://www.3cx.com/docs/ports/

I've destination port UDP 5060 allowed from Provider to 3CX server and from 3CX server to Provider, bidirectionaly. I can see calls setup correctly, but no voice and I know this is expected.
I then allowed DESTINATION port UDP 9000-10999 from Provider to 3CX server, following the arrows in the diagrams from the link below. it was not working.
https://www.3cx.com/docs/manual/firewall-router-configuration/

looking at the firewall log, it was actually 3CX using UDP 9000-10999 as SOURCE port, to communicate with Provider on some "random" ports. I then added a rule, something like "allow 3CX UDP port 9000-10999 to reach VOIP Provider UDP port any". and it worked.

it looks like I mis-understood the diagrams or there is some mis-configuration on our Fortigate firewall?

 

[Saqqara]

Have a look at this https://www.3cx.com/docs/ports/

These link may help you in setting up your firewall https://www.3cx.com/docs/fortigate-firewall-configuration/

To see if the firewall is configured correctly, run the firewall test within the management console

 

[AWS2P]

Hi,
Yes like Saqqara, first step is to see if 3CX firewall test passes green, if so, ports are normally ok to make calls with 3CX

 

[itops-care-bears]

I had the 2 links and they were in my original post as well. the test failed and I went back to the document to check the list of port required. then throughout the tests I realised UDP 9000-10999 need to be configured as SOURCE ports, which seems to be different from the documented direction.

hence posting the question here. could it be an issue with the document or my understanding of the descriptions? again the confusion I had was which side initiates the traffic for 3CX UDP9000-10999 traffic?

 

[YiannisH_3CX]

Hi @itops-care-bears

The provider needs to be able to send audio to you TO those ports but you should also be able to send the provider audio FROM those ports. So the ports need to open as a destination and a source.

In 99% of the cases outbound traffic is not blocked by firewalls so it is not mentioned in the guide. Firewalls are usually configured to block incoming traffic so the guide mentions that you need to open these ports so the provider can reach you.

Of course if you block outbound traffic as well then you need to open these ports as source ports as well.

 

[itops-care-bears]

Hi @itops-care-bears

The provider needs to be able to send audio to you TO those ports but you should also be able to send the provider audio FROM those ports. So the ports need to open as a destination and a source.

In 99% of the cases outbound traffic is not blocked by firewalls so it is not mentioned in the guide. Firewalls are usually configured to block incoming traffic so the guide mentions that you need to open these ports so the provider can reach you.

Of course if you block outbound traffic as well then you need to open these ports as source ports as well.

hi @YiannisH_3CX , thanks for confirming. appreciate your support as always.

 

[YiannisH_3CX]

Glad I could assist.