Solved Unable to access Management console but server is up and running

[bobmanuk]

Good Evening all,

I have a 3cx instance setup via pbxexpress with Microsoft Azure.

All my phones are connecting and calls are working just fine, my problem is, i cant access the console.

I try https://domain.3cx.co.uk

it has previously worked by putting the port number at the end IE: https://domain.3cx.co.uk:5001 (it was initially a v15 that has always been up to date with upgrades)

There are other 3cx instances that are also on my subscription that are still working fine, they all are on the same resource group/virtual network/subnet and no Network security rules have been added that would lock out access.

Im at a loss, any help is appreciated

 

[Evolute IT]

Good Evening all,

I have a 3cx instance setup via pbxexpress with Microsoft Azure.

All my phones are connecting and calls are working just fine, my problem is, i cant access the console.

I try https://domain.3cx.co.uk

it has previously worked by putting the port number at the end IE: https://domain.3cx.co.uk:5001 (it was initially a v15 that has always been up to date with upgrades)

There are other 3cx instances that are also on my subscription that are still working fine, they all are on the same resource group/virtual network/subnet and no Network security rules have been added that would lock out access.

Im at a loss, any help is appreciated

Connect in SSH and make sure the MC service is running.

 

[bobmanuk]

I was about to say i couldnt ssh on but thats because i blocked being able to..... changed that temporarily

this is what i get from "sudo service 3CX* status"

● 3CXPhoneSystemMC01.service - 3CX PhoneSystem 01 Management Console
Loaded: loaded (/lib/systemd/system/3CXPhoneSystemMC01.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2019-10-15 19:01:32 BST; 1h 49min ago
Main PID: 509 (3CXManagementCo)
Tasks: 35 (limit: 19660)
CGroup: /system.slice/3CXPhoneSystemMC01.service
└─509 /usr/lib/3cxpbx/3CXManagementConsole --pid /var/run/phonesystem/3CXPhoneSystemMC01.pid -p /var/lib/3cxpbx/Instance1/Data/Http/webroot

Looks to be up and running

 

[Evolute IT]

I was about to say i couldnt ssh on but thats because i blocked being able to..... changed that temporarily

this is what i get from "sudo service 3CX* status"




Looks to be up and running

That means it should work.

https://domain.3cx.co.uk and with :5001 doesn't work? Is the 443 or 5001 blocked in your firewall like SSH was?

 

[bobmanuk]

I had to move the rules around so that i could put IPs that i wanted to block as a higher priority, otherwise they could still get through, but that was about a month ago, and i was able to log in fine, until 3cx updated over the weekend.

As a test i moved the rule for 3CX_Management_Console_HTTPS back to the top, I still cannot access it.

But this is the weird thing, I can still access about 4 different PBX's from their FQDN just not my main one. on the main domain Phones still work, tranferring calls and everything else works ok. I just cant access the MC, and it isnt just from one location, the office, home and even on mobile network, still cant open the MC.

I tried a firewall test from one of the other PBX instances, and it looks to have passed without a problem.

 

[Evolute IT]

I had to move the rules around so that i could put IPs that i wanted to block as a higher priority, otherwise they could still get through, but that was about a month ago, and i was able to log in fine, until 3cx updated over the weekend.

As a test i moved the rule for 3CX_Management_Console_HTTPS back to the top, I still cannot access it.

But this is the weird thing, I can still access about 4 different PBX's from their FQDN just not my main one. on the main domain Phones still work, tranferring calls and everything else works ok. I just cant access the MC, and it isnt just from one location, the office, home and even on mobile network, still cant open the MC.

I tried a firewall test from one of the other PBX instances, and it looks to have passed without a problem.

What error does Chrome give you?

Also, open a Command Prompt (Win+R and type "cmd") and try a "nslookup fqdn.3cx.co.uk". Check that the given IP is the good one. Your local DNS (if any) might cause issues. Some ISPs DNS are very slow too sometimes.

 

[bobmanuk]

What error does Chrome give you?

Also, open a Command Prompt (Win+R and type "cmd") and try a "nslookup fqdn.3cx.co.uk". Check that the given IP is the good one. Your local DNS (if any) might cause issues. Some ISPs DNS are very slow too sometimes.

Chrome give me ERR_Connection_Refused for https://domain.3cx.co.uk and ERR_Connection_Timed_Out with domain ending in 5001

already checked the nslookup and the domain resolves to the same IP as the pbx, it has been a the same static IP since i set it up last year.

Thanks,

 

[Evolute IT]

Chrome give me ERR_Connection_Refused for https://domain.3cx.co.uk and ERR_Connection_Timed_Out with domain ending in 5001

already checked the nslookup and the domain resolves to the same IP as the pbx, it has been a the same static IP since i set it up last year.

Thanks,

Connection refused means the IP might have been blocked by the firewall or the built-in 3CX protections. Are you able to access the MC using another network? Like with your cellphone on LTE/3G.

 

[bobmanuk]

Connection refused means the IP might have been blocked by the firewall or the built-in 3CX protections. Are you able to access the MC using another network? Like with your cellphone on LTE/3G.

I have tried on 2 different 4g networks, from the office and from home.

none of them work and all show the same error.

I am tired from work so I’ll sleep on it and attack this again in the morning

thanks for the help anyway

 

[AWS2P]

is access with webclient giving you same error?
Is Azure firewall open to MC ports ?
Have you set console restrictions in 3CX ?

 

[JohnS_3CX]

Can you reach the MC via https://publicIP:5001 ?

 

[bobmanuk]

is access with webclient giving you same error?
Is Azure firewall open to MC ports ?
Have you set console restrictions in 3CX ?
View attachment 12729

Web client gives the same error

Azure has 443 port open (i can access other MC's just fine) and i have also forwarded port 5001 just in case and set it as a high priority, no change.
I never set any restrictions in the console as to where we can access it from, because i could end up at a handful of sites, i dont want to hinder my own access.

Can you reach the MC via https://publicIP:5001 ?

Same as with fqdn, connection timed out

 

[Evolute IT]

Web client gives the same error

Azure has 443 port open (i can access other MC's just fine) and i have also forwarded port 5001 just in case and set it as a high priority, no change.
I never set any restrictions in the console as to where we can access it from, because i could end up at a handful of sites, i dont want to hinder my own access.



Same as with fqdn, connection timed out

Is https://<public ip>/ directly working? (Without :5001)

 

[bobmanuk]

Is https://<public ip>/ directly working? (Without :5001)

Instant ERR Connection Reset

 

[JohnS_3CX]

Ok then, you can ignore the FQDN for now, it is probably not your issue.

Since this is a PBX Express deployment, then type https://publicIP only without the port. It will use the default SSL port of 443

If this does not work then I can imagine a couple of possibilities:

1. The port is actually blocked on the firewall or the machine
2. The nginx server is no longer listening for connections for any reason.

SSH into your machine with elevated privileges and run 3CXStopServices && 3CXStartServices

This will restart all the services for you so then you can try again to reconnect

 

[Evolute IT]

Ok then, you can ignore the FQDN for now, it is probably not your issue.

Since this is a PBX Express deployment, then type https://publicIP only without the port. It will use the default SSL port of 443

If this does not work then I can imagine a couple of possibilities:

1. The port is actually blocked on the firewall or the machine
2. The nginx server is no longer listening for connections for any reason.

SSH into your machine with elevated privileges and run 3CXStopServices && 3CXStartServices

This will restart all the services for you so then you can try again to reconnect

"Connection Reset" like he said does seem to be Nginx no longer listening!

 

[bobmanuk]

I have logged into the 3cx instance and stopped/started the services as advised.

i now get:

err connection refused when going to https://publicip and https://fqdn.3cx.co.uk
and err connection timed out when going to https://publicip:5001 https://fqdn.3cx.co.uk:5001

where as before restarting the services they were the other way around.

I also tried installing lynx (CLI browser if you arent aware) when trying to connect to localhost, 127.0.0.1 or the VM's actual internal IP. when using 5001 i get an SSL error, confirming it has another error and nothing loads, without 5001 i get unable to connect to remote host. worth a shot i guess.

EDIT -- also sudo service nginx stop / start doesnt seem to do much either, unless pbxexpress sets it up as a different name

EDIT 2 -- apparently lynx doesnt play well, so i tried elinks, which does actually display 3CX Management console OK when on the issue PBX, when loading another 3cx fqdn it also displays the same information. a good sign that its running locally. I will have to play around with the NSG rules and see what i can get.

EDIT 3 -- Fixed it, not sure why it stopped though because the rule wasnt there to begin with and had been working for months, through many reboots and edition updates, I had to setup a rule to forward any request for port 5001 to the IP of the PBX instance.

Thank you for all the help and patience.

 

[JohnS_3CX]

Looks like it was a firewall issue after all. Makes sense since the connection were refused, while at the same time the system services were running. Glad to hear it was resolved!