Solved Warning: 499 "Caller is forbidden"

Status
Not open for further replies.

jl@rag

Joined
Dec 4, 2017
Messages
12
Reaction score
1
Hi,

I got the newest 3CX PBX Pro Edition installed on Debian 9. We do have 4 NICs installed, eth0 for WAN and eth1 for LAN. eth2&3 not used yet, and not configured.

eth0: WAN IP
eth1: 10.2.2.1 without default gateway

Extension 251 IP: 10.2.2.3

ISC DHCP Server is running on the system, with option 68 for auto-provisioning. This works perfectly.

Now when I try to call someone, it doesn't matter if it's another extension or an external number, I get the error 499 "Caller is forbidden". Here is a tcpdump from a call that was from extension 251 to 278:

attached text file: tcpdump_caller_forbidden.txt

Here is the log from the 3CX:

Code:
12/04/2017 8:38:38 AM - Leg L:13.1[Unknown:] is terminated: Cause: BYE from PBX
12/04/2017 8:38:38 AM - [CM503013]: Call(C:13): Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 10.2.2.3:5060 tid=1091939237 [email protected]:
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 10.2.2.3:5060;branch=z9hG4bK1091939237
Max-Forwards: 70
Contact: <sip:[email protected]:5060>
To: <sip:[email protected]:5060>
From: "John Doe"<sip:[email protected]:5060>;tag=298142155
Call-ID: [email protected]
CSeq: 2 INVITE
Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE
Content-Type: application/sdp
Proxy-Authorization: Digest username="xXxXxXx",realm="3CXPhoneSystem",nonce="414d53595a24fb7e43:90371c13dccee7642933c939f6000206",uri="sip:[email protected]:5060",response="fc5583b28c6a9c9d071b78b8a76d2e1c",algorithm=MD5
Supported: replaces
User-Agent: Yealink SIP-T46S 66.82.0.20
Allow-Events: talk, hold, conference, refer, check-sync
Content-Length: 298

v=0
o=- 20020 20020 IN IP4 10.2.2.3
s=SDP data
c=IN IP4 10.2.2.3
t=0 0
m=audio 12568 RTP/AVP 0 8 9 18 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:9 G722/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=ptime:20
a=sendrecv
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15

Extension 278 is not provisioned via 3CX. It is connected via WAN and just SIP Username/Password. Extension 278 can call 251 but 251 can't call back. 251 can call nothing, not even other auto-provisioned phones. Other auto-provisioned phones can't call neither.

Every phone is a Yealink T46S.

BUT when I use the 3CX Windows Client in Softphone mode, I can call whatever I want.

Do you need any further information?
I just need to know why the 3CX PBS sends the Code 499/"Caller is unknown" and how I can prevent this.

Thank you.

JL
 

Attachments

Hello @jl@rag

What IP did you use as local when installing the system and what is the IP specified for under the extension settings / Phone provisioning?
Do you have a working invite from a client you can share so we can see what is different?
 
Hi,

when installing I already had the WAN IP configured on eth0, so I chose this as IP.
In the extension settings there is the 10.2.2.1 IP as provisioning. My link for auto-provision is like
http://10.2.2.1:5000/provisioning/XXXXXXXXXX
That is what my dhcp server propagades, and it works.

You want a working INVITE from a call I made with softphone? When I do this, I do come from an external IP via NAT and I do connect to my domain/WAN IP. External phones are the only working phones. See attachment tcpdump_caller_working_invite.txt

Here is my ip route show

default via 202.196.71.33 dev br0 onlink
10.2.2.0/24 dev eth1 proto kernel scope link src 10.2.2.1
202.196.71.32/27 dev br0 proto kernel scope link src 202.196.71.54

And my ip add:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
link/ether d8:df:0d:03:70:01 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP group default qlen 1000
link/ether 30:e1:71:6c:17:3c brd ff:ff:ff:ff:ff:ff
4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 30:e1:71:6c:17:3d brd ff:ff:ff:ff:ff:ff
inet 10.2.2.1/24 brd 10.2.2.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::32e1:71ff:fe6c:173d/64 scope link
valid_lft forever preferred_lft forever
5: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 30:e1:71:6c:17:3e brd ff:ff:ff:ff:ff:ff
6: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 30:e1:71:6c:17:3f brd ff:ff:ff:ff:ff:ff
7: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 30:e1:71:6c:17:3c brd ff:ff:ff:ff:ff:ff
inet 202.196.71.54/27 brd 202.196.71.63 scope global br0
valid_lft forever preferred_lft forever
inet6 fe80::32e1:71ff:fe6c:173c/64 scope link
valid_lft forever preferred_lft forever

interface ens1 is a beronet Gateway with ISDN Ports with IP 202.196.71.56

WAN IP addresses are altered.
 

Attachments

Your issue probably arises from the fact the your local Sip domain does not match what the local phones are sending as you chose the public IP during installation and the PBX does not recognise the source of the call.

Read point 9 of the following guide: https://www.3cx.com/docs/manual/configuring-your-pbx/

You should perform a backup without licence and FQDN un-install the system and re-install it selecting your local IP (without gateway) and after the installation switch the network interface to the public from Settings / Network / Select Network Card interface.
 
So even if it says "public IP address" while installation I should use the 10.2.2.1 interface?
What about my domain configuration? Should I point the A-Record of my domain to 10.2.2.1 or the real public IP 202.196.71.54?
 
When the Installation asks for your Public IP select the NIC with the WAN IP. Then for local IP select your local IP. After the installation is complete switch the network interface to the public from Settings / Network / Select Network Card interface. This way the local extension will connect to the local IP. If you are using your own domain that should point to the public IP for remote extensions to work.
 
Ok, this was the solution. I reinstalled 3CX with backup. Now everything works.
I think it was because I installed the beronet Gateway PCIe Card after the 3CX installation.
 
Glad to hear the issue is resolved and thank you for sharing your solution.
 
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
111,880
Messages
589,533
Members
164,733
Latest member
HLISolutions