Web client drops because of TCP packet issue

[briankelly64]

Thanks in advance....I need to do some additional testing on the server side but wanted to quickly see if anyone has seen this before.... communication with port 5001 seems to be the issue.


IP has been changed for security.

Short capture below is from laptop with web client.

Right after Keep-Alive in the capture the Chrome Web Client drops, waits some seconds (18) and then comes back for about 40 seconds and then goes offline again. Repeats over and over.

Web client is on remote wifi connected laptop without firewall or anti virus. Same behavior at different remote location. Server is up to date, Pfsense IS properly configured and passes 3cx network test. DSL at server location appears to be clean per carrier. Occasion lengthy Ping but no drop outs

3477    130.274493    62.210.32.129    192.168.1.145    TCP    66    5001 → 6373 [ACK] Seq=529 Ack=2349 Win=33024 Len=0 TSval=606029037 TSecr=7977301
3501    131.629103    62.210.32.129    192.168.1.145    TLSv1.2    133    Application Data
3624 141.627012   62.210.32.129    192.168.1.145  TLSv1.2 101 Application Data
3662 145.688031   62.210.32.129    192.168.1.145  TLSv1.2 100 Application Data
3674 146.260935   62.210.32.129    192.168.1.145  TCP 66 5001 → 6373 [ACK] Seq=563 Ack=2387 Win=33024 Len=0 TSval=606033034 TSecr=7978900
3733 151.631557   62.210.32.129    192.168.1.145  TLSv1.2 101 Application Data
3748 154.916747   62.210.32.129    192.168.1.145  TCP 78 [TCP Keep-Alive ACK] 5001 → 6372 [ACK] Seq=15474 Ack=3872 Win=38016 Len=0 TSval=606035197 TSecr=7975266 SLE=3871 SRE=3872
3907 161.272197   62.210.32.129    192.168.1.145  TCP 66 [TCP Previous segment not captured] 5001 → 6373 [ACK] Seq=597 Ack=2425 Win=33024 Len=0 TSval=606036787 TSecr=7980401
3909 161.645194   62.210.32.129    192.168.1.145  TCP 100 [TCP Retransmission] 5001 → 6373 [PSH, ACK] Seq=563 Ack=2425 Win=33024 Len=34 TSval=606036880 TSecr=7980401
4007 171.665424   62.210.32.129    192.168.1.145  TLSv1.2 224 [TCP Previous segment not captured] , Application Data, Application Data, Encrypted Alert
4051 176.284296   62.210.32.129    192.168.1.145  TCP 66 5001 → 6373 [ACK] Seq=597 Ack=2463 Win=33024 Len=0 TSval=606040537 TSecr=7981901
4054 176.681791   62.210.32.129    192.168.1.145  TLSv1.2 100 Application Data

 

[rgruber]

Just a few things that I can think of...

Make sure no firewall is on PBX or AV for testing. Is your WAN static? Are you sharing the same IP for all services or do you have a static block and is the PBX using a different IP from your firewall? Does your firewall checker on your PBX come back clean? Do you have all the ports forward?

Ports Used by 3CX Phone System - A complete list

About your PBX, all the network drivers and BIOS, chip updated...is it virtual?

About your client connecting...are all the drivers updated on it...BIOS, chip and network?

Have you tried MS Edge Chrome?

 

[ChrisC_3CX]

Hey @briankelly64,

In addition to what @rguber said, you could also provide us with the info mentioned in this thread so that we can have a better picture of your setup: https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

Also, just bear in mind that the firewall checker only tests UDP traffic so it might not help that much for this specific issue, but it's still a good idea to make sure you pass it just to get a general idea of whether the firewall is configured properly.

Do you happen to be running a VPN client on the client PCs?

Note: By the way, just to point out, the wireshark info provided shows only one-way traffic, have you maybe filtered the capture with source or destination IP?

 

[briankelly64]

Just a few things that I can think of...

Make sure no firewall is on PBX or AV for testing. Is your WAN static? Are you sharing the same IP for all services or do you have a static block and is the PBX using a different IP from your firewall? Does your firewall checker on your PBX come back clean? Do you have all the ports forward?

Ports Used by 3CX Phone System - A complete list

About your PBX, all the network drivers and BIOS, chip updated...is it virtual?

About your client connecting...are all the drivers updated on it...BIOS, chip and network?

Have you tried MS Edge Chrome?

Thanks for your questions and suggestions......

The WAN is a single static IP connected to a fast Pfsense box. Yes checker comes back clean. All drivers and software are up to date. Same behavior with Edge browser. Laptop on WIFI or directly connected to router at remote location yields same result.

Tried eliminating all VPN or Wireshark drivers on laptop which had no effect.

One interesting note is that when the remote laptop is connected with OpenVPN turned on and connected the packet issue that causes the web client to disconnect doesn't occur and the client stays connected. The VPN connection is considerably slower that the non-VPN connection.

 

[briankelly64]

Hey @briankelly64,

In addition to what @rguber said, you could also provide us with the info mentioned in this thread so that we can have a better picture of your setup: https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

Also, just bear in mind that the firewall checker only tests UDP traffic so it might not help that much for this specific issue, but it's still a good idea to make sure you pass it just to get a general idea of whether the firewall is configured properly.

Do you happen to be running a VPN client on the client PCs?

Note: By the way, just to point out, the wireshark info provided shows only one-way traffic, have you maybe filtered the capture with source or destination IP?

Interesting. I assumed it tested TCP also. Yes I did have a filter on in Wireshark. Thank you for your suggestions.

One interesting note is that when the remote laptop is connected with OpenVPN turned on and connected the packet issue that causes the web client to disconnect doesn't occur and the client stays connected. The VPN connection is considerably slower that the non-VPN connection.

3cx is standard Debian Linux dist from 3cx, Standard Annual (up to date), STUN for remotes

 

[briankelly64]

Just tried same extension on different laptop, chrome browser, same remote location, same router etc. The web client stayed connected! Hmmmmm.

 

[NickD_3CX]

Then it seems like you have found your culprit!