Subnet issues with AWS EC2

[Rowan]

Hello,

This probably isn't the correct forum to post this, but I don't have access to the Hosted forum, since our system is on-premises.

We are planning to move our PBX to EC2 soon, but our network configuration is posing an issue.

We have our PBX on the Public subnet of our VPC in AWS, which makes it easier for the PBX to contact the VoIP providers and vice versa and also allow use of the mobile app, without having to do port forwarding on the tunnel port.

The Private subnet in our VPC has a direct route to our LAN on premises and traffic flows freely between all the networks. There is no route from the Public subnet to the on premises LAN and vice versa.

Our phones on premises are on a separate VLAN that doesn't have direct access to the Internet.

How can I have the phones connect to the PBX that's on the Public subnet?

I tried installing the 3CX SBC onto the Private EC2 subnet to then use DHCP options to tell the phones where to find it, but I can no longer install the SBC from source.

 

[SweetAction]

SO the phone subnet can't get to WAN, but can get to LAN? And LAN can get to the WAN?

So setup some static routing in the phone subnet that next hop for 3CX is LAN, and from LAN it will follow your routes to WAN and 3CX. Of course, this is bad because of NAT, so a SBC is the correct option, so explain why you can't install a SBC?

 

[Rowan]

We can't make any changes to the LAN; it's controlled by another organization.

The 3CX PBX is on the public side of the VPC. There is no route (for obvious security reasons) to the Public subnet from the LAN.

The SBC can only be installed from the .iso and I can't get that into EC2.

 

[SweetAction]

There is no route (for obvious security reasons) to the Public subnet from the LAN.

So how do PCs in the LAN get to the WAN if there is no route? Like they can't browse to Google?

The SBC can only be installed from the .iso and I can't get that into EC2.

You can upload a custom image though, so setup a VM on your local machine with the SBC, capture and upload that.

 

[Rowan]

There is no route from the phone VLAN to the internet. PCs are able to get to the Internet.

I tried to migrate an SBC VM, but it errored out. AWS support said the image is missing "certain prerequisites", whatever that means.

 

[Rowan]

If anyone is interested in how I resolved this:

I placed the 3CX PBX on the public subnet and several 3CX SBCs on the private subnets. I also created a reverse proxy on the private subnet to forward requests from the phones. Split DNS with the internal record pointing to the proxy and the external pointing to the actual PBX. I then used DHCP option 66 to point the phones to the reverse proxy and configured each internal extension/user to use one of the SBCs. External 3CX app users will tunnel to the actual PBX address.

The only issue I foresee is users trying to connect with the app while on campus WiFi.