Restricted Port 5060 to Provider IP causes Delayed Ring on Phone but not App

jalzamora · Nov 6, 2020

I am using Flowroute and have restricted port 5060 on TCP and UDP to their two subnets for two of their POPs. This also causes the firewall test to fail only on full cone NAT.

US-East-VA	34.226.36.32/28, 34.226.36.32-34.226.36.47
US-West-OR	34.210.91.112/28, 34.210.91.112-34.210.91.127

When I make an inbound call the app rings immediately and then the phone rings 6-7 seconds later.

If I remove the restriction on port 5060, the firewall test succeeds and both the app and phone ring immediately. What am I doing wrong?

Attached are my firewall rules on Vultr.

leejor · Nov 6, 2020

Additional information, about your setup, would be helpful....

https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

jalzamora · Nov 6, 2020

Thank you so much for that. I will keep it bookmarked for future questions. Let me know if you need any additional information.

3CX Version: Standard Annual 16.0.655
Server OS: Debian GNU/Linux 9.13 (stretch)
Is the 3CX Server Hosted and where? Vultr - Atlanta
IP Phone Make/Model/Firmware: Yealink T21P E2 and Yealink T27P
Provisioning Method: STUN
Trunk Provider: Flowroute - US-East-VA and US-West-OR
Has the Firewall Checker passed: YES with 5060 wide open and NO with it restricted to Flowroute
Are custom Phone Templates being used: YES but it has done the same thing on a Standard template

leejor · Nov 6, 2020

So...is this a ring group, or is there an app associated with each extension? Have you looked at the 3CX Activity Log, to see the differences (delay?), for both scenarios?

cobaltit · Nov 6, 2020

STUN phones expect to get 3CX on port 5060. If you want to purse this unnecessary path you should implement a SBC for the phones.

jalzamora · Nov 9, 2020

leejor said:
So...is this a ring group, or is there an app associated with each extension? Have you looked at the 3CX Activity Log, to see the differences (delay?), for both scenarios?

Here is the log from restricted 5060:

11/09/2020 11:08:46 AM - Leg L:17.1[Line:10000<<+1214929XXXX] is terminated: Cause: BYE from local

11/09/2020 11:08:46 AM - [CM503008]: Call(C:17): Call is terminated

11/09/2020 11:08:46 AM - Leg L:17.2[Extn:658] is terminated: Cause: BYE from 181.42.37.59:21692

11/09/2020 11:08:45 AM - Currently active calls - 1: [17]

11/09/2020 11:08:40 AM - x-call-control DROP: call is not found: NzZ-U3l9W5sHeSxmSR7AVQ..;from-tag=88b6331d;to-tag=93cd4049

11/09/2020 11:08:40 AM - Leg L:17.3[Extn:658] is terminated: Cause: 487 Request Terminated/INVITE from 181.42.37.59:21731

11/09/2020 11:08:40 AM - [CM503003]: Call(C:17): Call to <sips:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 181.42.37.59:21731

11/09/2020 11:08:40 AM - Leg L:17.4[Extn:658] is terminated: Cause: 487 Request Cancelled/INVITE from 181.42.37.59:21684

11/09/2020 11:08:40 AM - [CM503003]: Call(C:17): Call to <sips:[email protected]:0> has failed; Cause: 487 Request Cancelled/INVITE from 181.42.37.59:21684

11/09/2020 11:08:40 AM - Leg L:17.5[Extn:658] is terminated: Cause: 487 Request Terminated/INVITE from 127.0.0.1:5483

11/09/2020 11:08:40 AM - [CM503003]: Call(C:17): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 127.0.0.1:5483

11/09/2020 11:08:39 AM - [CM503007]: Call(C:17): Extn:658 has joined, contact <sip:[email protected]:21692/TLS>

11/09/2020 11:08:39 AM - [CM503007]: Call(C:17): Line:10000<<+1214929XXXX has joined, contact <sip:[email protected]:0/UDP>

11/09/2020 11:08:39 AM - L:17.2[Extn:658] has joined to L:17.1[Line:10000<<+1214929XXXX]

11/09/2020 11:08:35 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [Yealink SIP-T27P 45.83.0.130 001565b2b122] PBX contact: [sips:658@3CXIP:5061;transport=TLS]

11/09/2020 11:08:35 AM - [CM503002]: Call(C:17): Alerting Extn:658 by contact <sip:[email protected]:21692/TLS>

11/09/2020 11:08:33 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [Yealink SIP-T21P_E2 52.84.0.95 805ec0ac6247] PBX contact: [sips:658@3CXIP:5061;transport=TLS]

11/09/2020 11:08:33 AM - [CM503002]: Call(C:17): Alerting Extn:658 by contact <sip:[email protected]:21684/TLS>

11/09/2020 11:08:25 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone for Windows 16.3.0.179] PBX contact: [sips:658@3CXIP:5061;transport=TLS]

11/09/2020 11:08:25 AM - [CM503002]: Call(C:17): Alerting Extn:658 by contact <sips:[email protected]:21731/TLS>

11/09/2020 11:08:25 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CX Mobile Client] PBX contact: [sip:[email protected]:5060]

11/09/2020 11:08:25 AM - [CM503002]: Call(C:17): Alerting Extn:658 by contact <sip:[email protected]:5483/UDP>

11/09/2020 11:08:25 AM - [CM503025]: Call(C:17): Calling T:Extn:658@[Dev:sip:[email protected]:21692;transport=TLS,Dev:sips:[email protected]:21731;transport=TLS;rinstance=0-b4b09b76ddf24dae952ed5d61c367ee6;ob,Dev:sip:[email protected]:21684;transport=TLS,Dev:sip:[email protected]:5483;rinstance=1389ad95948c0527] for L:17.1[Line:10000<<+1214929XXXX]

11/09/2020 11:08:25 AM - [CM503027]: Call(C:17): From: Line:10000<<+1214929XXXX ("J ALZAMORA" <sip:[email protected]:5060>) to T:Extn:658@[Dev:sip:[email protected]:21692;transport=TLS,Dev:sips:[email protected]:21731;transport=TLS;rinstance=0-b4b09b76ddf24dae952ed5d61c367ee6;ob,Dev:sip:[email protected]:21684;transport=TLS,Dev:sip:[email protected]:5483;rinstance=1389ad95948c0527]

11/09/2020 11:08:25 AM - [CM503004]: Call(C:17): Route 1: from L:17.1[Line:10000<<+1214929XXXX] to T:Extn:658@[Dev:sip:[email protected]:21692;transport=TLS,Dev:sips:[email protected]:21731;transport=TLS;rinstance=0-b4b09b76ddf24dae952ed5d61c367ee6;ob,Dev:sip:[email protected]:21684;transport=TLS,Dev:sip:[email protected]:5483;rinstance=1389ad95948c0527]

11/09/2020 11:08:25 AM - [Flow] No office hours set, office hours assumed

11/09/2020 11:08:25 AM - [Flow] Call(C:17): has built target endpoint: Extn:658 for call from L:17.1[Line:10000<<+1214929XXXX]

11/09/2020 11:08:25 AM - [Flow] Target endpoint for 658 is Extn:658

11/09/2020 11:08:25 AM - [CM503010]: Call(C:17): Making route(s) from Line:10000<<+1214929XXXX to <sip:658@3CXIP:5060/UDP>

11/09/2020 11:08:25 AM - [CM505003]: Provider:[Flowroute-US-East-VA] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [] PBX contact: [sip:10000@3CXIP:5060]

11/09/2020 11:08:25 AM - [CM500002]: Call(C:17): Info on incoming INVITE from Line:10000<<+1214929XXXX: Invite-IN Recv Req INVITE from 34.226.36.32:5060 tid=f7cd.ad37776af25f0276226702af4732c8be.0 [email protected]: INVITE sip:[email protected] SIP/2.0 Via: SIP/2.0/UDP 34.226.36.32:5060;branch=z9hG4bKf7cd.ad37776af25f0276226702af4732c8be.0 Via: SIP/2.0/UDP 54.71.6.127:5060;branch=z9hG4bKf7cd.6aeee2f2780576aa37e27b987e45df56.0 Via: SIP/2.0/UDP 34.211.73.216:5060;branch=z9hG4bKf7cd.ecbd82535ac1c80faeee578aeedb26a2.0 Via: SIP/2.0/UDP 23.29.25.54:5060;branch=z9hG4bK04Bb58c34e0e2d1d705 Max-Forwards: 66 Record-Route: <sip:34.226.36.32;lr> Record-Route: <sip:34.211.73.216;lr> Contact: "J ALZAMORA" <sip:[email protected]:5060> To: <sip:[email protected]> From: "J ALZAMORA" <sip:[email protected]>;tag=gK044b4dad Call-ID: [email protected] CSeq: 7062 INVITE Session-Expires: 1800 Min-SE: 90 Content-Type: application/sdp Supported: timer P-Asserted-Identity: "J ALZAMORA" <sip:[email protected]> Alias: JA DID Content-Length: 218 v=0 o=- 25788 23635 IN IP4 23.29.25.58 s=- c=IN IP4 23.29.25.58 t=0 0 m=audio 10346 RTP/AVP 0 18 101 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=maxptime:20

11/09/2020 11:08:25 AM - [CM503001]: Call(C:17): Incoming call from Line:10000<<+1214929XXXX to <sip:658@3CXIP:5060>

11/09/2020 11:08:25 AM - Line limit check: Current # of calls for line Lc:10000(@flowroute-US-East-VA[<sip:[email protected]:0/UDP>]) is 1; limit is 10

11/09/2020 11:08:25 AM - Timezone offset: -180 min.

jalzamora · Nov 9, 2020

leejor said:
So...is this a ring group, or is there an app associated with each extension? Have you looked at the 3CX Activity Log, to see the differences (delay?), for both scenarios?

Here is the log from unrestricted.

11/09/2020 11:22:53 AM - Leg L:18.2[Extn:658] is terminated: Cause: BYE from local

11/09/2020 11:22:53 AM - [CM503008]: Call(C:18): Call is terminated

11/09/2020 11:22:53 AM - Leg L:18.1[Line:10000<<+1214929XXXX] is terminated: Cause: BYE from 34.226.36.33:5060

11/09/2020 11:22:49 AM - x-call-control DROP: call is not found: JVh3XLOj3M1-BbwfWs7XcA..;from-tag=79c06058;to-tag=3f60771f

11/09/2020 11:22:49 AM - Leg L:18.3[Extn:658] is terminated: Cause: 487 Request Terminated/INVITE from 181.42.37.59:21731

11/09/2020 11:22:49 AM - [CM503003]: Call(C:18): Call to <sips:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 181.42.37.59:21731

11/09/2020 11:22:49 AM - Leg L:18.4[Extn:658] is terminated: Cause: 487 Request Cancelled/INVITE from 181.42.37.59:21684

11/09/2020 11:22:49 AM - [CM503003]: Call(C:18): Call to <sips:[email protected]:0> has failed; Cause: 487 Request Cancelled/INVITE from 181.42.37.59:21684

11/09/2020 11:22:49 AM - Leg L:18.5[Extn:658] is terminated: Cause: 487 Request Terminated/INVITE from 127.0.0.1:5483

11/09/2020 11:22:49 AM - [CM503003]: Call(C:18): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 127.0.0.1:5483

11/09/2020 11:22:48 AM - [CM503007]: Call(C:18): Extn:658 has joined, contact <sip:[email protected]:21692/TLS>

11/09/2020 11:22:48 AM - [CM503007]: Call(C:18): Line:10000<<+1214929XXXX has joined, contact <sip:[email protected]:0/UDP>

11/09/2020 11:22:48 AM - L:18.2[Extn:658] has joined to L:18.1[Line:10000<<+1214929XXXX]

11/09/2020 11:22:45 AM - Currently active calls - 1: [18]

11/09/2020 11:22:39 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [Yealink SIP-T27P 45.83.0.130 001565b2b122] PBX contact: [sips:658@3CXIP:5061;transport=TLS]

11/09/2020 11:22:39 AM - [CM503002]: Call(C:18): Alerting Extn:658 by contact <sip:[email protected]:21692/TLS>

11/09/2020 11:22:39 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [Yealink SIP-T21P_E2 52.84.0.95 805ec0ac6247] PBX contact: [sips:658@3CXIP:5061;transport=TLS]

11/09/2020 11:22:39 AM - [CM503002]: Call(C:18): Alerting Extn:658 by contact <sip:[email protected]:21684/TLS>

11/09/2020 11:22:39 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone for Windows 16.3.0.179] PBX contact: [sips:658@3CXIP:5061;transport=TLS]

11/09/2020 11:22:39 AM - [CM503002]: Call(C:18): Alerting Extn:658 by contact <sips:[email protected]:21731/TLS>

11/09/2020 11:22:39 AM - [CM505001]: Endpoint Extn:658: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CX Mobile Client] PBX contact: [sip:[email protected]:5060]

11/09/2020 11:22:39 AM - [CM503002]: Call(C:18): Alerting Extn:658 by contact <sip:[email protected]:5483/UDP>

11/09/2020 11:22:38 AM - [CM503025]: Call(C:18): Calling T:Extn:658@[Dev:sip:[email protected]:21692;transport=TLS,Dev:sips:[email protected]:21731;transport=TLS;rinstance=0-b4b09b76ddf24dae952ed5d61c367ee6;ob,Dev:sip:[email protected]:21684;transport=TLS,Dev:sip:[email protected]:5483;rinstance=1389ad95948c0527] for L:18.1[Line:10000<<+1214929XXXX]

11/09/2020 11:22:38 AM - [CM503027]: Call(C:18): From: Line:10000<<+1214929XXXX ("J ALZAMORA" <sip:[email protected]:5060>) to T:Extn:658@[Dev:sip:[email protected]:21692;transport=TLS,Dev:sips:[email protected]:21731;transport=TLS;rinstance=0-b4b09b76ddf24dae952ed5d61c367ee6;ob,Dev:sip:[email protected]:21684;transport=TLS,Dev:sip:[email protected]:5483;rinstance=1389ad95948c0527]

11/09/2020 11:22:38 AM - [CM503004]: Call(C:18): Route 1: from L:18.1[Line:10000<<+1214929XXXX] to T:Extn:658@[Dev:sip:[email protected]:21692;transport=TLS,Dev:sips:[email protected]:21731;transport=TLS;rinstance=0-b4b09b76ddf24dae952ed5d61c367ee6;ob,Dev:sip:[email protected]:21684;transport=TLS,Dev:sip:[email protected]:5483;rinstance=1389ad95948c0527]

11/09/2020 11:22:38 AM - [Flow] No office hours set, office hours assumed

11/09/2020 11:22:38 AM - [Flow] Call(C:18): has built target endpoint: Extn:658 for call from L:18.1[Line:10000<<+1214929XXXX]

11/09/2020 11:22:38 AM - [Flow] Target endpoint for 658 is Extn:658

11/09/2020 11:22:38 AM - [CM503010]: Call(C:18): Making route(s) from Line:10000<<+1214929XXXX to <sip:658@3CXIP:5060/UDP>

11/09/2020 11:22:38 AM - [CM505003]: Provider:[Flowroute-US-East-VA] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [] PBX contact: [sip:10000@3CXIP:5060]

11/09/2020 11:22:38 AM - [CM500002]: Call(C:18): Info on incoming INVITE from Line:10000<<+1214929XXXX: Invite-IN Recv Req INVITE from 34.226.36.33:5060 tid=144f.269dffd79fe43503dafb59251e6bd6ad.0 [email protected]: INVITE sip:[email protected] SIP/2.0 Via: SIP/2.0/UDP 34.226.36.33:5060;branch=z9hG4bK144f.269dffd79fe43503dafb59251e6bd6ad.0 Via: SIP/2.0/UDP 54.71.6.127:5060;branch=z9hG4bK144f.352cd40bc17927c7e4989a0102388bf7.0 Via: SIP/2.0/UDP 34.211.73.216:5060;branch=z9hG4bK144f.3f7ffefc551296d8bd4d361111497082.0 Via: SIP/2.0/UDP 23.29.31.54:5060;branch=z9hG4bK06B9c02377173d048b0 Max-Forwards: 66 Record-Route: <sip:34.226.36.33;lr> Record-Route: <sip:34.211.73.216;lr> Contact: "J ALZAMORA" <sip:[email protected]:5060> To: <sip:[email protected]> From: "J ALZAMORA" <sip:[email protected]>;tag=gK0666a355 Call-ID: [email protected] CSeq: 20612 INVITE Session-Expires: 1800 Min-SE: 90 Content-Type: application/sdp Supported: timer P-Asserted-Identity: "J ALZAMORA" <sip:[email protected]> Alias: JA DID Content-Length: 218 v=0 o=- 10166 23792 IN IP4 23.29.31.59 s=- c=IN IP4 23.29.31.59 t=0 0 m=audio 13548 RTP/AVP 0 18 101 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=maxptime:20

11/09/2020 11:22:38 AM - [CM503001]: Call(C:18): Incoming call from Line:10000<<+1214929XXXX to <sip:658@3CXIP:5060>

11/09/2020 11:22:38 AM - Line limit check: Current # of calls for line Lc:10000(@flowroute-US-East-VA[<sip:[email protected]:0/UDP>]) is 1; limit is 10

11/09/2020 11:22:38 AM - Timezone offset: -180 min.

jalzamora · Nov 9, 2020

cobaltit said:
STUN phones expect to get 3CX on port 5060. If you want to purse this unnecessary path you should implement a SBC for the phones.

Thank you for your reply. After digging around I think I understand what you are trying to explain to me.

If I set the phone to STUN then it wants to use port 5060 which means I would need them unrestricted to get it to work without the delay.

I factory reset the phone, installed the SBC, assigned an extension and logged in. The phone works perfectly with 5060 restricted on the PBX.

Maybe you can point me in the direction to figure out what I am missing with my logic or configuration. All of my phones are going to be standalone remote. I would prefer to not use the SBC application since only a single phone will be behind it. I would need a SBC for every user as they are all located in different locations. The phone functions perfectly but with the delay. Can I alter my phone configuration to have it skip the port 5060 process and just use the tunnel? (I might not be using all of the correct terms here so let me know if something isn't clear)

jalzamora · Nov 9, 2020

leejor said:
So...is this a ring group, or is there an app associated with each extension? Have you looked at the 3CX Activity Log, to see the differences (delay?), for both scenarios?

These are all remote users working in home offices. Each phone is just associated with a single extension as is the app.

leejor · Nov 9, 2020

jalzamora said:
Can I alter my phone configuration to have it skip the port 5060 process and just use the tunnel?

The 3CX tunnel is proprietary, so only 3CX devices are able to establish it, with the PBX.

jalzamora · Nov 9, 2020

leejor said:
The 3CX tunnel is proprietary, so only 3CX devices are able to establish it, with the PBX.

Ok so then my best bet is to leave the PBX restricted to Flowroute servers, give each remote user computer a static IP, install the SBC app and then auto-provision the phones or have them just use the softphone?

I am not going to be able to make a remote phone work without a delay if I restrict 5060 on the PBX.

cobaltit · Nov 10, 2020

I would say your best bet is not to restrict anything and let the 3CX global blacklist do it's job. As long a you have secure extension (default 3CX configuration) and keep 3CX up to date you should be fine

jalzamora · Nov 10, 2020

Ok, thanks for everyone's help.

Restricted Port 5060 to Provider IP causes Delayed Ring on Phone but not App

jalzamora

Attachments

leejor

jalzamora

leejor

cobaltit

jalzamora

jalzamora

jalzamora

jalzamora

leejor

jalzamora

cobaltit

jalzamora

Latest Posts

Forum statistics

20 Years of VoIP
Industry Leadership

Company

Solutions

Useful Links

Learn More

Restricted Port 5060 to Provider IP causes Delayed Ring on Phone but not App

Attachments

Forum statistics

20 Years of VoIP Industry Leadership

Company

Solutions

Useful Links

Learn More

20 Years of VoIP
Industry Leadership