V16 Bug, "Feature", or Oversight? - Remote STUN Phones and Console Restrictions

[Frick]

We have found that on version 16, phones at remote locations provisioned for STUN need to have their WAN IPs added to be allowed in the new Console Restrictions section (if you have the feature enabled to limited access to list IPs).

This wasted a bunch of our time in troubleshooting, but now that we got it figured out it was easy enough to added needed IPs. However, it does somewhat lower the security posture by having to add additional IPs that use the PBX, but do not need actual access to the console.

Was this added by design or something that will be changed in the future?

 

[NickD_3CX]

Hi Frick,

The purpose of the Console Restriction is that and only that, to not allow access to the Management Console. All other access should be allowed normally, like provisioning links, WebClient, etc.

I tried this and I couldn't seem to have the problem you had. Could it be possible that you had been blacklisted before you enabled the Console Restriction?

 

[Frick]

Hi Nick,

There is a possibility the IPs found there way onto the black list. We had 4 instances of the issue (the only 4 remote STUN provisioned phones we have). We did notice the phone credentials stopped working after the upgrade, so they may have triggered a blacklist entry before any troubleshooting.

Overall, every Fanvil X4 phone he have had to be factory reset and re-provisioned after upgrading 3CX to v16 (local, SBC or on STUN). It is very reasonable that they were blacklisted in the whole process. We will go back and change our troubleshooting workflow for future issues.

 

[NickD_3CX]

In that case I think this may have been the reason. I am glad you brought it up though, we can never be too thorough with things, especially when they are about security features...