Problem with clients (Android and IOS)

[Evgeniy Kabiolskiy]

Hello.

I've noticed issue.

3cx server runs at Debian9 with public IP.
Firewall tests are OK
LAN phones use SIP/TLS and SRTP
mobile phones are configured for SIP/TLS, SRTP and Tunnel
Systems operates correctly except sound disappears after several days up at mobile clients
LAN phones at the same time has no issue

So IOS and Android apps doesn't produce audio. Green three bars (at IOS app) are grey)))

I'd done next tests.
0) Turning OFF Tunnel switch at the app - no sound.
Returned setting back.
1) change sip setting at the app to UDP and RTP - to unsecure - sound returns after Re-register. Tunnel switch is ON. Returned setting back.
2) I'd restarted SIP/Tunnel proxy - nothing changed
3) I'd restarted Media server - sound returns.

So sound returned after restarting Media server with first time settings ( SIP/TLS, SRTP and Tunnel)

Media server log doesn't contained any errors...

Any ideas?

 

[Evgeniy Kabiolskiy]

It seems that something wrong with documented port range at firewall for 3CX

[395991.297114] iptables denied: IN=ens192 OUT= MAC=00:50:56:a0:44:23:e8:b7:48:cb:e9:7f:08:00 SRC=176.226.x.y DST=37.75.x.y LEN=106 TOS=0x00 PREC=0x00 TTL=58 ID=47153 PROTO=UDP SPT=33782 DPT=9519 LEN=86

[395991.297817] iptables denied: IN=ens192 OUT= MAC=00:50:56:a0:44:23:e8:b7:48:cb:e9:7f:08:00 SRC=176.226.x.y DST=37.75.x.y LEN=106 TOS=0x00 PREC=0x00 TTL=58 ID=19821 PROTO=UDP SPT=33782 DPT=9519 LEN=86

[395991.320404] iptables denied: IN=ens192 OUT= MAC=00:50:56:a0:44:23:e8:b7:48:cb:e9:7f:08:00 SRC=176.226.x.y DST=37.75.x.y LEN=210 TOS=0x00 PREC=0x00 TTL=58 ID=40962 PROTO=UDP SPT=44118 DPT=9518 LEN=190

[395994.976465] iptables denied: IN=ens192 OUT= MAC=00:50:56:a0:44:23:e8:b7:48:cb:e9:7f:08:00 SRC=1176.226.x.y DST=37.75.x.y LEN=210 TOS=0x00 PREC=0x00 TTL=58 ID=29751 PROTO=UDP SPT=44118 DPT=9518 LEN=190

Iptables are configured due to docs:

-A INPUT -d 224.0.1.75/32 -p udp -j ACCEPT
-A INPUT -p tcp -m multiport --dports 5000,5001,5060,5061,5090 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m multiport --dports 5060,5090 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9000:9398 -j ACCEPT
-A INPUT -p udp -m multiport --dports 9000:9398 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 10600:10998 -j ACCEPT
-A INPUT -p udp -m multiport --dports 10600:10998 -j ACCEPT

Restarting mediaserver causes (I guess) reseting port numbers so mobile clients begin to work

Is anybody knows correct port ranges?

 

[Evgeniy Kabiolskiy]

Is it correct to modify /var/lib/3cxbx/Bin/startup script and replace

-A INPUT -p tcp -m multiport --dports 9000:9398 -j ACCEPT
-A INPUT -p udp -m multiport --dports 9000:9398 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 10600:10998 -j ACCEPT
-A INPUT -p udp -m multiport --dports 10600:10998 -j ACCEPT

with

-A INPUT -p tcp -m multiport --dports 9000:10998 -j ACCEPT
-A INPUT -p udp -m multiport --dports 9000:10998 -j ACCEPT

due to https://www.3cx.com/docs/ports/
?

 

[YiannisH_3CX]

Hello @Evgeniy Kabiolskiy

Please note that mobile clients are not designed to work with SIP/TLS, SRTP and tunnel so you may face issues because of that. Also your IP tables look wrong as a big part of audio ports is missing.
The document you quoted clearly states that the port range is 9000-10999. I would recommend opening all ports in the range to avoid audio issues.
The startup script you mentioned looks like someone has already made changes to it as the original looks nothing like yours.

 

[Evgeniy Kabiolskiy]

Thank you for reply.
First of all I'm using last release of 3cx at Debian9

The document you quoted clearly states that the port range is 9000-10999. I would recommend opening all ports in the range to avoid audio issues.

I did it. And now everything works fine. We need some time for tests.
I've modified original /var/lib/3cxpbx/Bin/startup script

BUT!
Clean install of 3cx contains these rules.

Also firewall check tool at 3cx (at dashboard) checks only these ports.

resolving 'stun-eu.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX SIP Server... done
stopping service... done
detecting SIP ALG... not detected
testing port 5060... done
starting service... done
testing 3CX Tunneling Proxy... done
stopping service... done
testing port 5090... done
starting service... done
testing 3CX Media Server... done
stopping service... done
testing ports [9000..9398]... done
testing port 9000... done
...output omitted...
testing port 9392... done
testing port 9394... done
testing port 9396... done
testing port 9398... done
testing ports [10600..10998]... done
testing port 10600... done
testing port 10602... done
...output omitted...
testing port 10992... done
testing port 10994... done
testing port 10996... done
testing port 10998... done
starting service... done

Also you wrote

Please note that mobile clients are not designed to work with SIP/TLS, SRTP and tunnel so you may face issues because of that

What do you mean?
Have I to disable TLS and SRTP on mobile phones?
Or have I disable tunnel?

 

[YiannisH_3CX]

The firewall checker checks some of the first and last ports so it doesn't have to check 2000 ports, however all ports are needed.
The 3CX tunnel is not designed to work together with TLS. If you have everything working and do not experience any issues then leave it as is. If you face any issues however i would recommend disabling the tunnel to see if that works.

 

[Evgeniy Kabiolskiy]

I've found that TLS/SRTP with Tunnel gives bigger delay to voice then tunnel-less configuration.

I cannot understand why.