Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 2 answers
  • Subscribers 43 subscribers
  • Views 9473 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

3CX on premise behind XG 125

Marcus Michaels

Hi all,

I am new to the XG and I used to have a LANCOM routers in front of a PFSense.

My issue is, that I try to set up my 3CX PBX, so that I can have soft clients connect from the WAN side.

I did not change anything on the LANCOM side where it used to work before I exchanged the PFSense for the XG. I just changed the port forwarding IP to the private IP on one WAN port of the XG. Other rules like SMTP, SQL etc do work fine.

I did turn of SIP ALG on the XG.

I have made a business rule from any, over the WAN Port, using a service group with all the services needed and forwarded it the internal IP of the PBX in the LAN zone. As mentioned, this procedure works fine with other services, such as SMTP, HTTP, SQL...

However the firewall checker for the 3CX keeps telling me that the ports are remapped.

Output looks like

 

 

  • testing 3CX SIP Server... failed (How to resolve?)
    • stopping service... done
    • detecting SIP ALG... not detected
    • testing port 5060... Mapping does not match 5060. Mapping is 53650. (How to resolve?)
    • starting service... done
  • testing 3CX Tunneling Proxy... failed (How to resolve?)
    • stopping service... done
    • testing port 5090... Mapping does not match 5090. Mapping is 53684. (How to resolve?)
    • starting service... done
  • testing 3CX Media Server... failed (How to resolve?)
    • stopping service... done
    • testing ports [9000..9398]... failed (How to resolve?)
      • testing port 9000... Mapping does not match 9000. Mapping is 57726. (How to resolve?)

 

Does anyone have hints for me how to solve the issue?

Regards,

 

Marcus



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I suspect you will need an outgoing firewall rule -> Source LAN network PABX destination WAN network phone provider FQDN port 5060 allow, log, MASQ. This I believe can also be achieved in a business rule setup as SNAT but I am not sure about that setup.

    The incoming business rule (DNAT) will depend on how your external customers connect to your XG?

     

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi,

    Thanks for your reply. I added an outgoing rule, but it didnt have any effect.

    I have a little update. As I have two WAN lines, I forced all outgoing traffic of the PBX through the same WAN port as I expect traffic to come in. Stupid me.

    The firewall checker now detects port 5060 as good, but all other ports are worse now. (e.g. no more remapping as in my initial post)

     

     

    • resolving 'stun-eu.3cx.com'... done
    • resolving 'stun2.3cx.com'... done
    • resolving 'stun3.3cx.com'... done
    • resolving 'sip-alg-detector.3cx.com'... done
    • testing 3CX SIP Server... done
      • stopping service... done
      • detecting SIP ALG... not detected
      • testing port 5060... done
      • starting service... done
    • testing 3CX Tunneling Proxy... failed (How to resolve?)
      • stopping service... done
      • testing port 5090... full cone test failed (How to resolve?)
      • starting service... done
    • testing 3CX Media Server... canceled
      • stopping service... done
      • testing ports [9000..9398]... canceled

     

    Best

    Marcus

     

  • 0 in reply to Marcus Michaels

    Assuming the tunnelling proxy is used for outgoing, you could add port 5090 to the outgoing rule.

    The media server is for incoming traffic?

    Also do a search of the knowledge base. from memory there is an article on the subject.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Marcus Michaels

    So... It seems I have solved the rest.

    In the services configuration I had to change the source ports.

    For example for 5060 it has to be 1:65535 -> 5060, which is the default anyhow.

    This might have to do with the firewall in the LANCOM modem, as you cant configure it as an exposed host, but need NAT there as well. I forwarded the ports to the internal IP of the XG on that WAN port.

     

    So in basic I have an incoming rule from ANY, ANY using one of my WAN Ports and all the services, such as SIP, SIPS, Tunnel, RDP... (all are explained in the 3CX firewall config. Make sure to allow 1:65535 as source ports, i grouped them in a service group) and the target LAN, with the IP of your PBX. I did not check MASQ, nor reflective rule.

    In addition I have an outgoing rule to force the traffic of my PBX over one specific WAN port, the same I use for the incoming rule. This might not be neccessary, if you only have one WAN line. I checked MASQ and chose the proper gateway.

     

    It works like a charm.

  • 0 in reply to Marcus Michaels

    i nice day at all

     

    i have the same issues, can you make a screenshot of the rule have created? 

     

    tnx

  • 0 in reply to Daniele Caleca

    Hi Daniele,

    what is your exact issue, as it isn't just one simple rule.

    It is a mixture of 3CX, XG and your router(s).

     

    Can you provide some more details?

     

    Best

     

    Marcus

  • 0 in reply to Daniele Caleca

    Sevgili Daniele,

    Cihazımda çalışan 3CX FW ve Sample NAT kuralını ekliyorum.

  • 0 in reply to Marcus Michaels

    i have issues that 3cx  firewall test pass sometime ramdom ports, sometime no

  • 0 in reply to Daniele Caleca

    I had a persistent error - First two ports (9000-9002) will never pass test.

    I changed to have 8000 onwards, then 8000-8002 will never pass test. Whatever port I set in 3CX, first 2 ports will fail.

     

    For an unrelated issues, I changed my admin port of XG from 4444 to 4446.

    Magically, all ports pass.

     

    So, you may try this.

Reply
  • 0 in reply to Daniele Caleca

    I had a persistent error - First two ports (9000-9002) will never pass test.

    I changed to have 8000 onwards, then 8000-8002 will never pass test. Whatever port I set in 3CX, first 2 ports will fail.

     

    For an unrelated issues, I changed my admin port of XG from 4444 to 4446.

    Magically, all ports pass.

     

    So, you may try this.

Children
No Data
Unfiltered HTML