Rogue Stun Servers?

[RandyChev]

I had stun server problems today. The Server Event Log simply said: STUN server 173.212.195.222:3478 could not be reached (time out three times) every 20 minutes.

But when I checked the Server Activity Log it listed three servers that timed out, 173.212.195.222, 94.198.96.7, 198.50.247.220. Those seem to be in PA, Italy, and FL, respectively. I have my system to use stun servers stun.3cx.com, stun2.3cx.com and stun3.3cx.com. Somehow I don't think these are in Pennsylvania, Italy and Florida. Or am I wrong? I've blocked some of these ip ranges in the past for hacking attempts but I've been having no problems with my remote extensions until today.

I simply gave up trying to fix my remote issues (could not call out.. got "Forbidden" message, but could answer calls) and it finally resolved itself sometime in the afternoon. These stun servers seem to be a mystery to me. Any insights from any Stun Wizards out there?

 

[DimitriSuter]

If you resolve stun.3cx.com / stun2.3cx.com / stun3.3cx.com in your CMD, you get a reply from exactly those IP Adresses. And yes, 3CX is a global company with offices all over the planet, quiet possible they operate some servers in those parts of the world. Besides, the stun servers are more of a courtesy than a mission critical service, for those who don't have static public IP's to run their IP phone system with - expect them to be unavailable from time to time.
Your problems with external extensions looks like firewall / nat type configuration issues.

The 3CX phone system manual provides some really good tips how to install and operate remote extensions, worth having a read through - I did, learned a lot from it.

 

[bardissi]

We have a much better answer on how to handle remote phones.

The answer is the use of a Session Border Controller.

When provisioning remote phones you would use Remote Extension Using Sip Proxy manager and enter the address of the SBC here.

What the SBC does is re-writes the packet headers of the remote phones to Traverse NAT so that the phones simply find home and work.

Its much more reliable than STUN especially when you have more than 2 or 3 remote phones at 1 site

If you want to try it out send me the public ip address of your 3cx server and I can send you back the address of the SBC.