Solved Remote site firewall setup for STUN

[rmalchi]

Hi all,
I'm not clear on this, when setting up port/NAT forwarding on the remote site firewall which external ports and which internal ports do I open?
I can see instructions for first phone to open local port 5065 for SIP and 14000-14019 for RTP, which I can confirm is how the phone was provisioned. What external port should I set on the router? is it also 5065 and 14000-14019?

Thanks
Roy

 

[JohnS_3CX]

Hi Roy,

Exactly, you will open the ports that specific phone uses, and the same goes for each other STUN phone at that site. Make sure the SIP port is always unique for each phone at that site, and the RTP range is also unique (it should not overlap with that of other phones).


By the way, if you are using more than a couple of phones at that site, you should consider deploying a 3CX SBC instead of having to deal with all the STUN setup.

 

[rmalchi]

Thanks John, so you mean do you mean both internal and external are the same port ranges? If so, how does the phone communicate to the 3CX PBX which is open on ports 5060 not 5065 etc?

 

[JohnS_3CX]

Hi Roy,

Thanks John, so you mean do you mean both internal and external are the same port ranges?

Yes exactly, both internal and external need to be the same for the phone

If so, how does the phone communicate to the 3CX PBX which is open on ports 5060 not 5065 etc?

It's just a simple misunderstanding, I hope I can clear it up:

- The phone listens on 5065 (incoming traffic, so firewall rule needed)
- The phone speaks to 5060 to the remote side (outgoing traffic, no rule needed)

 

[rmalchi]

Ok, thanks John, now its clear

 

[JohnS_3CX]

You're welcome!