nat problem between pfsense and 3cx
-
Hi everyone, I have a local 3CX PBX, and a PfSense as a firewall.
Through this official procedure: https://www.3cx.com/docs/pfsense-firewall/, I was able to solve the NAT problem of the ports of the 5090 and 5061.
Despite this, I still have the problem of the NAT of the ports 9000 to 10999 of the Media Server.
I'll post the rules made on PfSense and the error that 3CX gives me with the firewall checker.Also I wanted to know, to make the 3CX app work outdoors, do I have to open any particular door?
thanks everyone for the support
-
@vettalex Did you set up the outbound NAT? (Step 2: Port Preservation (Full Cone NAT))
-
@steveits Hi, I think I have done everything correctly, I post you the photo of the conf:
-
@vettalex ptm0.2-ppp0 PROXY 9000 192.168.100.9 9000 udp 1000
ptm0.2-ppp0 PROXY 1194 192.168.100.9 1194 tcp 83.2xx.xx.xx add napt
ptm0.2-ppp0 PROXY 80 192.168.100.9 80 tcp add napt ptm0.2-ppp0 PROXY 443 192.168.100.9 443 tcp
ptm0.2-ppp0 PROXY 1194 192.168.100.9 1194 udp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5090 192.168.100.9 5090 tcp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5090 192.168.100.9 5090 udp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5060 192.168.100.9 5060 tcp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5060 192.168.100.9 5060 udp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5061 192.168.100.9 5061 tcp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5061 192.168.100.9 5061 udp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5000 192.168.100.9 5000 tcp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 5001 192.168.100.9 5001 tcp 83.2xx.xx.xx add napt ptm0.2-ppp0 PROXY 500 192.168.100.9 500 tcp 83.2xx.xx.xx
add napt ptm0.2-ppp0 PROXY 500 192.168.100.9 500 udp 83.2xx.xx.xx
add napt ptm0.2-ppp0 PROXY 4500 192.168.100.9 4500 tcp 83.2xx.xx.xx
add napt ptm0.2-ppp0 PROXY 4500 192.168.100.9 4500 udp 83.2xx.xx.xx
These are the ports opened by my provider.
Important thing !: if I bypass pfsense, everything works regularly (i.e. I set the IP of the pfsense wan on the 3cx switchboard and connect it directly to the router) -
@vettalex said in nat problem between pfsense and 3cx:
These are the ports opened by my provider
So there is an ISP router outside of the pfSense, and 192.168.100.9 is your pfSense WAN IP? Then because of the double NATing the ISP router will also need SIP-ALG off, static mapping, etc. Can it be set as a bridge?
What 3CX license do you have? Pro and higher have free hosting...there are caveats but it's available. (we're 3CX Partners but our clients host in our data center, where there is no NAT)
-
@steveits Hi Steve, thanks for the reply and sorry for my late reply (I have a 3 month old baby who does not let us sleep as much
).
So, the 3cx license is free, and the possibility to host it for free expired in November 2020, now I need to set the ports correctly between 3cx, pfsense and the router.
I made a scheme (very simple) to make you understand my network.
I want to clarify that if I set the 3cx ip, with the pfsense ip wan (192.168.100.9), the 3cx checker gives me everything correctly green. Surely the setting problem is on PfSense, at 100%.
-
@vettalex I add updated screenshots on the rules set:
-
Thread https://www.3cx.com/community/threads/pfsense-2-4-x-full-cone-test-failed.72102/post-321768 links to a Google doc which may be slightly different. I might try creating one rule per port (range) rather than one rule for all the ports. There are some that need UDP or TCP only, as well, see https://www.3cx.com/docs/manual/firewall-router-configuration/ and/or https://www.3cx.com/docs/ports/.
I would also suspect the double NAT from the ISP router is getting in the way. Is it possible to bridge or passthrough that so the pfSense gets the public IP on its WAN?
You might post in the 3CX forum linked above as well.
-
@steveits hi Steve, unfortunately it is not possible to configure in bridge, nor to configure the wan directly on pfsense (maybe). However I will divide the ports for each service with its protocol (tcp or UDP) and see how it goes. I will also read the link above, I have already opened a post on the 3CX community.
-
@SteveITS Hi Steve, I followed your advice, reset all the rules and following the following link, redid the rules, All working! thanks to the availability!
https://www.3cx.com/docs/pfsense-firewall/