Router phones - are they non-tunnel connections?

[JonnyM]

I'd like to keep "block remote non-tunnel connections" enabled for as many extensions as possible, but I'd like to understand how this setting interacts with router phones and phones connected through those router phones first. We're trying to move away from a VPN to our 3CX instance and router phones are part of this, currently we are testing with a Snom D862.

As far as 3CX is concerned, what of the following is true:

• Router phones count as a non-tunnel connection
• Phones connected through a router phone count as a non-tunnel connection
• The router phone SBC connection back to 3CX is a tunnel, the phone itself then registers through the SBC that it is hosting, other phones also register through this SBC so everything is a tunnel
• None of the above is relevant, the tick box needs to be unchecked for any extension being used remotely from the 3CX instance

Ideally I'd have a situation where people can use remote handsets that can run the 3CX SBC on them, but random drive-by attempts to register as one of our extensions would be blocked, I'm not sure this is possible though.

 

[CentrexJ]

This one is correct

• The router phone SBC connection back to 3CX is a tunnel, the phone itself then registers through the SBC that it is hosting, other phones also register through this SBC so everything is a tunnel

 

[JonnyM]

Excellent news, so I can leave that box ticked to block non-tunnel connections. I assume since this is a 3CX SBC connection I don't need to worry about things like NAT keepalives, problems caused by people's home routers having SIP ALG enabled etc. It's sounding like I should have bought a few more handsets to test this with as at least on paper it solves a ton of problems.