Stun address and ports needed

[jlabuelo]

Good morning all

Again I am having problems with my 3CX PBX system being registered in my voip provider. The error code I can see in the Server Status is:
[CM506004]: STUN request to STUN server 80.239.235.209 has timed out; used Transport: 192.168.2.10:5060
[CM506004]: STUN request to STUN server 208.73.212.12 has timed out; used Transport: 192.168.2.10:5060

As you can see I have two different Stun servers to register the internal IP address of the 3CX PBX.

Then if I run the Firewall test I get this error messages:

Parameters

Stun Server to test stunserver.org
Stun Port to test 3478
Port Range to be tested 9000-9015


and the result I get for each of the ports 9000-9015 is :

# Port Status Description Parameters
1 9000 Error (4) The STUN server returned an ip which is not accessible from outside. addrFromSTUN = 213.60.109.15:16977
2 9000 Error (6) An incompatible NAT configuration has been detected. Please check FAQ for further information. addrFromAgent = 213.60.109.15:16993addrFromSTUN = 213.60.109.15:16977
3 9000 Warning (8) Local port is not blocked from outside. STUN server has returned global port different from the local one, but the local port is also accessible from outside.
4 9000 Warning (10) Port is open, but port number has been changed. In many cases, this will present a problem and cause one way audio or no inbound calls. See this FAQ: http://www.3cx.com/support/firewal-checker.html externalAddress = 213.60.109.15:16977

I have the PBX installed in a Windows 2003 Sever behind a router which is conected via cable to my Internet provider.
Also I have checked with tracert and 213.60.109.15 is the external IP address I have now assigned by my Internet provider.

The firewall in the Windows 2003 Server is turned off, and the router has these ports opened and redirected to the Windows 2003 Server.

3478
5060
9000-9015

Is there any other port I must have open? What I dont understand is that if I have the Stun server port 3478 openend and the ports for external calls 9000 to 9015 also opened, why the stun server is trying to "enter" using another ports like 16977???

1 9000 Error (4) The STUN server returned an ip which is not accessible from outside. addrFromSTUN = 213.60.109.15:16977

Is there any place that specify which ports I should have open and redirected to the PBX server???... what I wont like is to have the router with all the ports open


Another thing I have tried is to set the option "Registration Settings -- Which IP to use in 'Contact' field for registration:" to with the value : Specified IP: 64.69.76.23:5060, instead of having "External (STUN resolved)"

With this I can register... but can not get any call... I mean I get the ring, but when I pick up, the call is disconected and does not get any sound.


any help on how to set the right ports and stun configuration.??.. anyone can pass me his stun configuration and explain me how to set the ports???

thanks a lot in advance guys!!.

 

[jlabuelo]

For those that had this problem I found a "possible workarround":

The problem is that the NAT protocol changes the ports once the shoket is sent to the STUN server. Even I have the 9000-9015 ports opened in my router, the STUN server is trying to enter using ports like 17000, 1756.... which are closed.

This is because the router, that I got from my Internet provider, is configured with Simetric NAT, which is not allowed for VOIP.

To solve this, the right solution is moving the NAT configuration of the router from Simetric NAT to "Full Cone NAT or also called One to One NAT". The problem is that the router I have (like a lot of routers) can only work with Simetric NAT, so the solution I had to choose is opening all the ports in the router for the IP address of my PBX Server.

Hope this helps to someone.

Cheers guys