WebClient not secure

[DTP JOHN]

Hello! can you help me? Is it normal for the webclient site to show the message not secure? If not, what can I do to find a possible solution?

 

[SnakeRiverWebDevelopment]

You are supposed to use the FQDN, not the ip address

 

[DTP JOHN]

OK! The FQDN usually doesn't work, that's why we use the IP, would there be any configuration to be done?

 

[SnakeRiverWebDevelopment]

My guess is that the PBX is self hosted, if the FQDN does not work it is a firewall issue. Have you run the firewall checker?

 

[DTP JOHN]

I haven't done the execution yet, thanks for the tip

 

[SteveITS]

See the text of https://www.3cx.com/community/threads/post-in-relevant-category.115838/

Also if self hosted see https://www.3cx.com/docs/creating-fqdn-split-dns/

 

[TheodorosG_3CX]

It is expected to see this since you are using a local ip address.
If you cannot resolve the FQDN from your pc, this is network/firewall issue that needs to be checked.

 

[pbpunisher]

I have the issue where I am using a Ubiquiti Dream Machine. The firewall checker is fine. I have all my ports in the forwarding of it. It is not a DNS server so I see no way of doing a split DNS or haipin nat. So now what? I'm testing this on my system before rolling it out to customers.

 

[SweetAction]

I have the issue where I am using a Ubiquiti Dream Machine. The firewall checker is fine. I have all my ports in the forwarding of it. It is not a DNS server so I see no way of doing a split DNS or haipin nat. So now what? I'm testing this on my system before rolling it out to customers.

If you can't do DNS changes on a DNS server you'll have to manually edit the host file on each PC to handle this.

Or consider hosting it in the cloud. If you don't have the ability to handle DNS onsite (or turn on hairpin nat), what other issues will you run into?

 

[pbpunisher]

See the text of https://www.3cx.com/community/threads/post-in-relevant-category.115838/

Also if self hosted see https://www.3cx.com/docs/creating-fqdn-split-dns/

And what if you are self-hosted but are not running a DNS server? I have the UDM pro and it supposed to automatically do that hairpin nat from what I understand, but it is not working and I see now way of putting one it. I have multiple customers in this configuration that if there is no work around I will not be able to upgrade them to v20.

 

[pbpunisher]

If you can't do DNS changes on a DNS server you'll have to manually edit the host file on each PC to handle this.

Or consider hosting it in the cloud. If you don't have the ability to handle DNS onsite (or turn on hairpin nat), what other issues will you run into?

Thank you, I forgot all about the local host file. But yes, this adds a layer I was not expecting and will be difficult as some customers do some administering themselves of the system. So if I understand this correctly, all users getting into their web interface even for their extensions will have this issue correct. That is going to be very problematic. I won't have a choice to either move them to the cloud, or to install a DNS server.

 

[SteveITS]

Curious, I tried to search and with one exception the best I could find is that it's supposed to work but has been buggy off and on over time. However, I found this post which ends with an example of forwarding with a source of the LAN subnet:

https://community.home-assistant.io/t/unifi-dream-machine-nat-loopback-issue/221457/7

"Interface: WAN
From: Limited
Source: 192.168.1.0/24"

I was also going to mention the hosts file....note that doesn't work with mobile apps or devices without a configurable hosts file.

 

[SweetAction]

Thank you, I forgot all about the local host file. But yes, this adds a layer I was not expecting and will be difficult as some customers do some administering themselves of the system. So if I understand this correctly, all users getting into their web interface even for their extensions will have this issue correct. That is going to be very problematic. I won't have a choice to either move them to the cloud, or to install a DNS server.

I'm confused and hoping you can help me here.

The org can't:

1. Have a DNS server? I mean you can literally run one a Pi - that's like a 1 time $100 cost - I even wrote a guide on it
2. Have a proper firewall that can handle NAT or DNS? You can pick up an old desktop off ebay for under $100 and install pfSense for free.
3. Use the 3CX Free or Pro hosted by 3CX? We're talking totally free or like $205 for a 4SC Pro Hosted per year.

It's like, there is a bunch of options here and it's for a business, right? Why can't the business spend a couple of dollars to do it correctly? It costs money to turn on the lights and somehow you aren't being told "spin the crank for us" or "we'll use candles". Why is telephones different?

 

[pbpunisher]

Thank you, I understand all of that. As stated, I work with mostly SMB and have used mainly Unifi for routing. I do understand also that I can turn up DNS on multiple applications including pfsense. I just am not happy that I will have to go to customers and charge them for additional equipment, or move them to a hosted solution.

 

[TecMate]

@pbpunisher your Unifi Dream Machines (UDM) has a DNS server built-in. Though much of the confusion revolves around how Unifi implements and lets you manage DNS.

1) Make sure you have your DHCP server set to point DNS traffic to your UDM. Under Networks > typically your "Default" Network > DHCP Service Management > Show Options > set the DNS server to the LAN IP address of your Dream Machine.
2) Under "Client Devices" > locate your local 3CX server > open it and go to Settings (top right) > tick the box for local DNS record and type in the FQDN of your 3CX server (i.e. "yourcompany.3cx.us" of whatever your FQDN is).

Make sure your client devices get the new DNS server from DHCP > ipconfig /release && ipconfig /renew > ipconfig /all to check DNS Server and make sure it's pointing to your UDM's IP address.

nslookup > type in your 3CX FQDN and het enter and if everything is configured correctly you should get back the local network address of your 3CX server.

This is called "Split DNS" clients inside your LAN get the local LAN IP address of the 3CX server while clients outside the network get the public address of your UDM which you would need to setup Port Forwarding for all the external traffic.

EDIT: Also to make it easier you can also setup DoH or "DNS Shield" under Settings > Security > General > set "DNS Shield" to "Auto." This will setup DNS over HTTPS (DoH) to forward to CloudFlare and Google DoH Servers. Then once again make sure you setup your Default LAN network DHCP settings to "DNS Server" = "Auto" or manually set it to the LAN IP address of the UDM.

Both methods are tested and working.

 

[pbpunisher]

@pbpunisher your Unifi Dream Machines (UDM) has a DNS server built-in. Though much of the confusion revolves around how Unifi implements and lets you manage DNS.

1) Make sure you have your DHCP server set to point DNS traffic to your UDM. Under Networks > typically your "Default" Network > DHCP Service Management > Show Options > set the DNS server to the LAN IP address of your Dream Machine.
2) Under "Client Devices" > locate your local 3CX server > open it and go to Settings (top right) > tick the box for local DNS record and type in the FQDN of your 3CX server (i.e. "yourcompany.3cx.us" of whatever your FQDN is).

Make sure your client devices get the new DNS server from DHCP > ipconfig /release && ipconfig /renew > ipconfig /all to check DNS Server and make sure it's pointing to your UDM's IP address.

nslookup > type in your 3CX FQDN and het enter and if everything is configured correctly you should get back the local network address of your 3CX server.

This is called "Split DNS" clients inside your LAN get the local LAN IP address of the 3CX server while clients outside the network get the public address of your UDM which you would need to setup Port Forwarding for all the external traffic.

EDIT: Also to make it easier you can also setup DoH or "DNS Shield" under Settings > Security > General > set "DNS Shield" to "Auto." This will setup DNS over HTTPS (DoH) to forward to CloudFlare and Google DoH Servers. Then once again make sure you setup your Default LAN network DHCP settings to "DNS Server" = "Auto" or manually set it to the LAN IP address of the UDM.

Both methods are tested and working.

Thank you for all the information. I tried everything to the detail of what you suggested and it does show that it's resolving. Then I was having HSTS issues. Cleared that, and now it's back to where it was acting like it's not resolving although it resolves in nslookup.

 

[SteveITS]

acting like it's not resolving although it resolves in nslookup.

That description could be DNS over HTTPS (DoH) or DoT. Try disabling that in your browser. Split DNS only works if the browser is using the local DNS...