STUN phone does autoprovision but does not register

[Frank86]

I'm setting up a Yealink T56a as a STUN phone but it gets stuck on registering.
The phone autoprovisions just fine and shows the user's extension number.
The Eero router at the remote location is set up with the proper port forwarding to the phone's LAN IP address (which has an IP reservation).
I've disabled the Disallow use of extension outside the LAN setting under the extension's Options tab.
The phone is properly set up under the extension's Phone Provisioning tab.
I'm using port 5065 as the Local SIP Port of Phone. (Is that still the right port to use? The field defaults to 5060).
The public IP address of the network with the STUN phone is not blacklisted by 3CX.

What am I missing?

 

[cobaltit]

Does the firewall checker pass on the 3CX side? You say you are 'using' port 5065 but the phone defaults to 5060. You shouldn't be touching anything other than straight provisioning so it's concerning when you say that.

 

[Frank86]

The firewall checker hasn't passed since I've upgraded to v16 last year, even though the configuration hasn't changed and everything works fine. But I have restricted port 5060 TCP/UDP to Flowroute's IPs in the firewall.

I'm using port 5065 because that's what I'd read in the 3CX documentation in regards to configuring STUN phones. But I did notice that when I added the phone to the user's 3CX extension as STUN, it did default the SIP port to 5060. And when I logged onto the phone's web interface, it did show 5060, which I changed to 5065

I could change the port back to 5060 (on phone, 3CX extension, remote router port forwarding) and remove the IP restriction to the Flowroute IP addresses in the firewall and see if that works.

 

[BrenttG]

Were talking about inbound vs outbound here.

The ip restriction on the PBX is likely incoming port 5060.

The port you are setting on the deskphone is outbound port 5060, or 5065, this is different, however you do need to remove that ip restriction for this to work, or add the public ip of the deskphone to the restriction.

Every connection has a source and destination port number.

[Deskphone]:5065 -> 5060:[PBX]

Essentially port 5065 on the desk phone connects to port 5060 at the PBX, each side of the connection has a port number. This is usually transparent, and most mid level IT people i meet have no knowledge that it works this way, they never knew there is always a source port number for every connection. And getting them to understand the way it works usually blows their mind, or they think im making it up because they have never heard it before.

When you set ports on an extension in 3CX, you are assigning the source ports, the port for the deskphone side of the connection. The ports on the PBX are static, except for RTP which bounces around within its allowed range of course.

 

[Frank86]

Ok. I removed the IP restriction in the firewall. I'll check the remote phone in a bit.
Thank you.

 

[Frank86]

After removing the IP restrictions in the firewall (where the PBX is installed), the remote phone is working fine. Thank you.

Just so to be clear, when configuring a remote phone via STUN, is it ok to use port 5060 instead of port 5065? The 3CX documentation I read mentions that 5065 must be used for remote phones.

 

[BrenttG]

you can safely use any port between 5060-5079, 5092-alot, i skip some because some internal 3CX services use those ports internally, just to make sure there are no conflicts, note that if there is more than one phone at the same location, each must have its own ports.

 

[Frank86]

Great. Thank you.