Solved unable to access remote admin console via Adsl

[Aphteon]

Hello,

Very strange :
About a configuration "on-premise mode", I can access to the 3cx admin console via my phone in accesspoint mode (connection share) with my pc but not when I initiate the connection via adsl. With another adsl connection same problem.

I tried to remove all blacklist ip. No change. (for info => https://domain_name.my3cx.fr:5001/).

I use a draytec vigor 165 router.

Can you help me ?

 

[leejor]

Do you have port 5001 forwarded? Does the 3CX Firewall Checker all pass?

 

[Aphteon]

Thanks for your reply.

Yes, all is correct (redirection + checker). Remember, that is ok when I use my Phone and the function "mobile share connection" (like a modem) via 4G and my computer. But, with the same computer and with the adsl link : no access.
I tried to reboot the router and restart 3cx services. Nok.

 

[Saqqara]

Thanks for your reply.
But, with the same computer and with the adsl link : no access.

Please explain more , is your pc on a network outside of the 3cx network or on the same network

 

[cobaltit]

This is a networking issue. You'll want to evaluate your network or hire someone who understands networking to help you. If you can hit the console from your phone then clearly 3CX is working.

 

[leejor]

Whether it is ADSL, or Cable, or 4G, it should make no difference the technology used, if all are outside your local LAN. If you can gain access using one method (4G), in, though your router, then, unless specific IPs are being blacklisted, or blocked (somehow), in theory all should have an equal chance of access. As suggested, you need someone familiar with, or understands, your network setup.

 

[Aphteon]

Thanks for your replies.

I just want to add some informations :
- ToIP and VoIP run correctly
- Problem is uniquely from external access with adsl
- Problem is the same with FQDN or IP

As a reminder :

- 3CX Firewall checker is ok

----------------------------------------------
IP Configuration :
IPBX_3CX : 10.0.0.253 /8
Router Draytec : 10.0.0.200 /8
DNS : From ISP
External IP : static
---------------------------------------------

Via adsl : no access, via 4g : access. I use the same computer. At this time, the difference (unless I'm mistaken), is with wich address ip I try to access to the PBX. It's the reason I temporarily deleted the blacklist ip : no change.

Remains that the problem may be related to the router.

 

[AWS2P]

From your DSL line are you able to ping your pbx using FQDN, is a PBX nslookup FQDN resolving?

 

[JohnS_3CX]

If you have access to the draytec, then why not run a capture on it and see if the aDSL IP shows up when you try to connect? Quite possibly you will see the request coming in and the draytec blocking it

 

[Saqqara]

Have you changed the security settings to block access to certain ip

https://www.3cx.com/docs/manual/pbx-management/#h.x1xh0oxyb7tk - Managing Your PBX Security

 

[Aphteon]

Thanks you.

AWS2P : I can ping from anywhere with IP and DNS. NSLookup ok.
SAQARRA : All paramaters by default here, no restrictions
JohnS_3CX: Good Idea. I try that today and come back later.
Note that I deactivated advanced firewall feature on the draytec.

 

[Aphteon]

Here the result of the draytec NAT Active Sessions Table after trying connection :
Private IP Port #Pseudo Port Peer IP Port Interface
10.0.0.253 5001 5001 83.196.245.xyz (My adsl IP) 43230 WAN1
10.0.0.253 5001 5001 92.184.124.abc (My 4G IP) 51320 WAN1

It seems to be ok (router respond at the demand and initiate the nat correctly) but the problem is the same. I note too that application 3cx on my android phone run only in 4G mode, not via the wifi (via adsl).

I added my adsl ip address in whitelist to bypass the draytec firewall. Same result.

I run a netstat on the 3cx console, from 4G connection :
tcp 0 0 3cx.domain_name.local:5001 pop.92-184-124-10:51803 ESTABLISHED
tcp 0 0 3cx.domain_name.local:5001 pop.92-184-124-10:51795 ESTABLISHED

 

[Alphabetic]

The ADSL connection you're coming from, are you at a different location to the PBX?

Can you try http://portquiz.net:5001 to see if port 5001 is going out on the internet from your ADSL

 

[AWS2P]

what is portquiz ? is it safe site?

 

[Aphteon]

Kiefershield
I tried from my computer : :
-------------------------------------------------------------------------
Outgoing port tester
This server listens on all TCP ports, allowing you to test any outbound TCP port.
You have reached this page on port 5001.

Your network allows you to use this port. (Assuming that your network is not doing advanced traffic filtering.)
Network service: unknown
Your outgoing IP: 92.184.124.abc
--------------------------------------------------------------------------

I tried with another computer in another location : same problem.

 

[leejor]

Are you able to easily, to swap out the Dratec router with another for a quick test? Even a basic, older, residential router most of us have sitting in a box. Do the port forwarding, and set the IP range correctly. If you have access from everywhere, you'll know it is something on the Draytec.

 

[SweetAction]

Random question - have you tried with the 3cx global blacklist disabled?

 

[Aphteon]

Are you able to easily, to swap out the Dratec router with another for a quick test? Even a basic, older, residential router most of us have sitting in a box. Do the port forwarding, and set the IP range correctly. If you have access from everywhere, you'll know it is something on the Draytec.

I replaced the draytec by an home router (Dlink), i didn't have any problems. What can i deduce ? 3cx firewall checker ok. What's the difference between two internet type connections (4G, Adsl) at the router level ? I begin to think maybe the cause is about the adsl configuration modem (mtu, Encapsulation mode, protocol, modulation...)

 

[Aphteon]

Random question - have you tried with the 3cx global blacklist disabled?

Yes I did it, no change.

 

[leejor]

I assume that when you say you didn't have any problems, that you were able to get through after the router swap. Have you tried doing a factory reset on the Draytec, then , from the default, start with the local IP settings, and port forwarding. See if it works. Did you do the original install of the Draytec?