Problem with remote client connection to 3CX Phone system

[vstar2]

hello

I have tried to connect a sip client for Windows to 3CX Phone System server.
I have success in local network but
error occurred for remote client.
Scheme is
My client (local ip 192.168.1.123) -> Modem/Router (external ip 91.77.28.245) -> Router (external ip 195.168.150.230) -> 3CX Phone System server on VMWare Virtual Machine (local ip 192.168.17.102).

With Wireshark capturing on 3CX Phone System server i can see

Internet Protocol, Src: 91.77.28.245 (91.77.28.245), Dst: 192.168.17.102 (192.168.17.102)
Transmission Control Protocol, Src Port: 1506 (1506), Dst Port: 5060 (5060), Seq: 1, Ack: 1, Len: 555
Session Initiation Protocol
Request-Line: REGISTER sip:195.68.150.230 SIP/2.0
Via: SIP/2.0/TCP 192.168.1.2:54294;branch=z9hG4bK-d8754z-d942f07defe02cf9-1---d8754z-;rport
Max-Forwards: 70
Contact: <sip:[email protected]:54294;rinstance=fdbb588747701763;transport=TCP>
To: "2222"<sip:[email protected]>
From: "2222"<sip:[email protected]>;tag=aa15779b
Call-ID: MjZmNGFkYmNhMjRiYzU3YjQxZjJmMzk1NDg4Y2VkMmU.
CSeq: 1 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
User-Agent: X-Lite 4 release 4.0 stamp 58832
Content-Length: 0

Internet Protocol, Src: 192.168.17.102 (192.168.17.102), Dst: 91.77.28.245 (91.77.28.245)
Transmission Control Protocol, Src Port: 5060 (5060), Dst Port: 1506 (1506), Seq: 1, Ack: 556, Len: 525
Session Initiation Protocol
Status-Line: SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/TCP 192.168.1.2:54294;branch=z9hG4bK-d8754z-d942f07defe02cf9-1---d8754z-;rport=1506;received=91.77.28.245
Proxy-Authenticate: Digest nonce="414d535c04352f6d63:136b50a3ba278b0d915f331fabae3cf8",algorithm=MD5,realm="3CXPhoneSystem"
To: "2222"<sip:[email protected]>;tag=b133cb24
From: "2222"<sip:[email protected]>;tag=aa15779b
Call-ID: MjZmNGFkYmNhMjRiYzU3YjQxZjJmMzk1NDg4Y2VkMmU.
CSeq: 1 REGISTER
User-Agent: 3CXPhoneSystem 10.0.19079.0
Content-Length: 0

Internet Protocol, Src: 91.77.28.245 (91.77.28.245), Dst: 192.168.17.102 (192.168.17.102)
Transmission Control Protocol, Src Port: 1506 (1506), Dst Port: 5060 (5060), Seq: 556, Ack: 526, Len: 766
Session Initiation Protocol
Request-Line: REGISTER sip:195.68.150.230 SIP/2.0
Via: SIP/2.0/TCP 192.168.1.2:54294;branch=z9hG4bK-d8754z-d178f6cf4966bb6c-1---d8754z-;rport
Max-Forwards: 70
Contact: <sip:[email protected]:54294;rinstance=fdbb588747701763;transport=TCP>
To: "2222"<sip:[email protected]>
From: "2222"<sip:[email protected]>;tag=aa15779b
Call-ID: MjZmNGFkYmNhMjRiYzU3YjQxZjJmMzk1NDg4Y2VkMmU.
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
Proxy-Authorization: Digest username="2222",realm="3CXPhoneSystem",nonce="414d535c04352f6d63:136b50a3ba278b0d915f331fabae3cf8",uri="sip:195.68.150.230",response="a96d7bb09bc4c2597ad4683cd38e95ae",algorithm=MD5
User-Agent: X-Lite 4 release 4.0 stamp 58832
Content-Length: 0

Internet Protocol, Src: 192.168.17.102 (192.168.17.102), Dst: 91.77.28.245 (91.77.28.245)
Transmission Control Protocol, Src Port: 5060 (5060), Dst Port: 1506 (1506), Seq: 526, Ack: 1322, Len: 396
Session Initiation Protocol
Status-Line: SIP/2.0 403 Invalid password provided
Via: SIP/2.0/TCP 192.168.1.2:54294;branch=z9hG4bK-d8754z-d178f6cf4966bb6c-1---d8754z-;rport=1506;received=91.77.28.245
To: "2222"<sip:[email protected]>;tag=40596b2c
From: "2222"<sip:[email protected]>;tag=aa15779b
Call-ID: MjZmNGFkYmNhMjRiYzU3YjQxZjJmMzk1NDg4Y2VkMmU.
CSeq: 2 REGISTER
User-Agent: 3CXPhoneSystem 10.0.19079.0
Content-Length: 0

So i can't register my client with CX Phone System server.

Can anybody help me to solve this problem?

thanks

Vstar2

 

[leejor]

Re: Problem with remote client connection to 3CX Phone syste

Status-Line: SIP/2.0 403 Invalid password provided

Could this be one issue? What does the 3CX server log look like?

 

[vstar2]

Re: Problem with remote client connection to 3CX Phone syste

Logs look like

Windows log

SIP request (REGISTER) from 91.77.28.245 was rejected. Reason: Block WAN requests is ON.
Message:
REGISTER sip:195.68.150.230 SIP/2.0
Via: SIP/2.0/TCP 192.168.1.2:36332;branch=z9hG4bK-d8754z-eb81e4a265dac0b4-1---d8754z-;rport=1511;received=91.77.28.245
Max-Forwards: 70
Contact: <sip:[email protected]:36332;rinstance=39071d8ab68ad039;transport=TCP>
To: "2222"<sip:[email protected]>
From: "2222"<sip:[email protected]>;tag=805feb55
Call-ID: NzMyMWZhNzEzZWNkMTJiNmI2OGNiMTZjMWRkNGQxMzU.
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
Proxy-Authorization: Digest username="2222",realm="3CXPhoneSystem",nonce="414d535c04353bee11:6ad5cb5cd8b8a6759490bcbdd8d04bb9",uri="sip:195.68.150.230",response="f59b7c5498efd70c5a9befc9886dff09",algorithm=MD5
User-Agent: X-Lite 4 release 4.0 stamp 58832
Content-Length: 0

3CX log

01:51:43.156 [CM102001]: Authentication failed for SipReq: REGISTER 195.68.150.230 tid=eb81e4a265dac0b4 cseq=REGISTER [email protected]:36332 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

 

[willow]

Re: Problem with remote client connection to 3CX Phone syste

looks like the passwords dont match.

 

[vstar2]

Re: Problem with remote client connection to 3CX Phone syste

I can connect inside local area network with the same login and password.
The problem occurred when i try to do that between remote client and 3CX Phone Server.
3CX Phone Server is working on VMWare Virtual Machine (network connection is auto-bridging).

 

[eagle2]

Re: Problem with remote client connection to 3CX Phone syste

Trivial, but have you allowed extension usage outside of LAN (in extension settings | other on 3CX server ?)

Have also passed firewall check on 3CX server?

Another question have set STUN server on remote extension ? I didn't dig too deep into the log but internal addresses appear as destination addresses, which could be a problem.

Regards

 

[vstar2]

Re: Problem with remote client connection to 3CX Phone syste

Thank you.
It's really trivial.
i didn't allowed this extension for outside of LAN.

Best regards!