Webclient from external

[EdisonInfo]

3cx v16 latest. Just upgraded last night. I can access and log into the webclient from inside the building. Outside I can get the webpage but no matter what credentials I enter it just shows in red letters An IP had been blocked. I check the IP black list and my IP is not in the list. I added it to the whitelist just to be sure. Port 443 is in use by the firewall. I have port 5001 tcp and udp forwarded to the phone sytem but locked to my IP. I am not comfortable at all with opening the management console to the world!!! What am I missing? Some remote users are saying they are gettng a 403 error when I had it open to the world for testing.

 

[Alphabetic]

Ensure that the firewall passes on all ports and you use the URL specified in your extension welcome email (and that you're not trying to log in to the MGMT console). Webclient will show :5001/webclient after url.

from your external location go to www.whatsmyip.org and grab your IP. Then log in to your MGMT console (from where you can) and click the Blacklisted IP button from the middle section, locate your IP and either whitelist it or delete it.

try again.

 

[rgruber]

I would reboot your server first, take a screenshot of all your blacklists, then remove every one of them in the management console. Open up your firewall to all console access to the world and test. 5001 TCP only needs to be opened.

 

[EdisonInfo]

As mentioned, I have done all that. I get the webclient login screen. However non of the ext/pwd combos that work inside the building will work outside.

 

[Saqqara]

The 3CX system only has one username and password , that can be accessed internally and externally if the network is setup correctly.

Which user name are you trying - this is the admin user account

Check the blacklist, as you may have locked yourself out.

 

[EdisonInfo]

The webclient asks for an extension number and password.

 

[Saqqara]

The webclient asks for an extension number and password.

This is not the 3cx management console - the web address will be https://fqdn:5001

The webpage you are pointing to is the webclient https://fqdn:5001/webclient , you need to enable it for each extension. The setting is under General tab - Web Authentication, the only way to get the password is to send the welcome email to the user

 

[rgruber]

That can be found by sending a welcome email to the user that you are trying to log in as. A valid email has to be set up in there user profile to receive. You will log in using ext number and password from the email.

admin access is https://your.fqdn.com:5001
webclient access is https://your.fqdn.com:5001/webclient

 

[Alphabetic]

Have you been checking IP blacklist from the front main page or from Security > Console Restrictions?

 

[EdisonInfo]

Sorry, there seems to be some confusion. This thread was Not about the management console, it is about getting the /webclient to login. They both are on port 5001 which makes me very queasy but that is a different issue for a different thread.

I inherited this system which has been in place for around 5 years maybe? As users report issues I try to fix them. I guess I need to find out first if they things they are complaining about ever worked!

 

[EdisonInfo]

Have you been checking IP blacklist from the front main page or from Security > Console Restrictions?

Yes, mentioned that in the initial post

 

[Saqqara]

Have you tried creating a new extension, to see if that works as you have upgraded the system,.

Does the 3cx management console, work externally ?

 

[Alphabetic]

If you're confident that your IP's are not in the blacklist then I would reboot 3CX and try again.

if that fails then I suggest you review the router firewall rules and make sure 3CX passes on the firewall checker and then test before you decide to "lock it down" again.

https://www.3cx.com/3cxacademy/videos/basic/nat-port-forwarding/

 

[NickD_3CX]

I just had an idea, from the outside you are not able to access the /webclient.
I guess you are trying:
https://<FQDN>:5001/webclient

Could you try:
https://<Public IP>:5001/webclient
?
You will get a browser warning error, but just ignore for the purpose of this test and try.

 

[rgruber]

Its a great system, not sure if you have experience with others at other companies. Anyway, Try that restart first and open up those ports to the world to test. You can always apply the security back after the test. I'm asking this so there isn't a firewall issue with restricting IP since we can't see your firewall configuration.

 

[Alphabetic]

I just had an idea, from the outside you are not able to access the /webclient.
I guess you are trying:
https://<FQDN>:5001/webclient

Could you try:
https://<Public IP>:5001/webclient
?
You will get a browser warning error, but just ignore for the purpose of this test and try.

From what I understood he is getting to the login screen externally but gets Blacklisted IP in red

 

[EdisonInfo]

Thank you everyone for the help. I am not sure which or maybe all of the things I tried worked, but for now. It is all working as it should both inside and from outside.

Now to research why the management console port has to be open to the world, ugh....

 

[Alphabetic]

go through the slides from the academy above and you will see why. Then restrict console access to IP via security tab

 

[rgruber]

No problem, glad its working

 

[NickD_3CX]

@EdisonInfo
Great news!

From what I understood he is getting to the login screen externally but gets Blacklisted IP in red

I was thinking that maybe for some reason the FQDN had got mapped to a different IP, where there is a 3CX, just not his, and possibly that is why they were seeing a Login Screen, but credentials didn't work.