Solving problems with remote connections in 3CX / 3CX Ltd. Blog

We periodically receive calls about incorrect operation of remote users connected to 3CX through a corporate NAT router or a firewall. This article provides a step-by-step guide to resolving remote connection problems.

Unfortunately, 3CX cannot guarantee the correct operation of “direct” remote connections, especially without the use of 3CX Tunnel technology.

Correct operation is not guaranteed for the following reasons:

• Specific or incorrect network topology;
• Specific or incorrect settings of the router or firewall both from the 3CX side and from the remote user;
• Incorrect operation of NAT or SIP ALG services in network devices (sometimes eliminated by updating the firmware);
• Blocking of certain ports by Internet providers (for some operators or in hotels);
• Lack of access for a VoIP specialist to network equipment, i.e. the inability to configure the customer’s network for VoIP applications.

What should I look for if you encounter problems when connecting remotely?

Remote connection permission for user

In the 3CX management interface, go to the User properties on the Settings tab

• To enable a “direct” remote connection, disable the Deny connection outside the local network option.
• In order to allow remote connection via 3CX Tunnel, disable the Deny connection from public network via 3CX tunnel option

Publication of 3CX services (port forwarding) on ​​a router

First of all, we note that the simpler the topology of your network, the fewer intermediate devices between the 3CX server and the WAN interface of the router that external users connect to, the greater the chance of success. You may not even suspect that the Internet provider did not give you a “white” IP address on the WAN interface, but a “gray” IP from its internal network. This is especially often observed in business centers where the Internet is distributed via an internal local area network.

For the correct connection of external users, as well as for the passage of the audio and video stream of them, the following ports should be published (forwarded to the IP address of the 3CX server) on the router:

• 5060 UDP - SIP port of the 3CX server
• 9000-9500 UDP - RTP Audio / Video Stream with Remote User
• 5090 UDP and TCP - 3CX Tunnel Service Port
• 5000 - 5001 or 80/443 - HTTP ports for 3CX web service

We recommend that you review the full list of ports used by 3CX.

Remote SIP devices with NAT support

If you plan to use a direct SIP connection (i.e. without 3CX Tunnel technology), it is recommended that you use only supported 3CX phones . They, in particular, correctly support the following functions:

• Rport
• STUN
• Keep - Alive

Connect one of the recommended phones remotely and make sure it is registered on 3CX. Make a call to the 3CX ping * 777 . If you configured the router correctly on the 3CX server side (as described above), but the call does not go away, or the audibility is one-way - most likely the problem is in the router that connects the remote IP phone to the Internet (i.e., on your side).

Try connecting again, but using 3CX Tunnel (3CX SBC). If the audibility is normal, you should return to the router settings - update the firmware, make sure the port forwarding settings are correct, contact the manufacturer’s technical support, etc.

Using 3CX Tunnel and 3CX Session Border Controller

If you are at a loss to determine the reason for incorrect registration of the remote subscriber, or cannot achieve two-way audibility, we recommend that you refuse the “direct” SIP connection and use the 3CX Tunnel technology. 3CX Tunnel is integrated in 3CX Client for all platforms. If you need to connect a hardware phone or a group of phones, we recommend using the 3CX Session Border Controller .

Using 3CX Firewall Checker Client

If you still need to get the “direct” connection working correctly, we recommend that you start the 3CX Firewall Checker Client . The main task of this utility is to determine whether static port forwarding to the 3CX server is configured correctly. Using 3CX Firewall Checker Client can “give a hint” in the following situations:

• Remote subscriber is not registered
• One-way audio with remote party
• Problems with the STUN server

The 3CX Firewall Checker Client error log will allow you to roughly figure out where to look for the source of the problem.

Routers with SIP ALG and SIP Helper

Many routers have a feature called SIP ALG or SIP Helper. SIP ALG modifies the SIP packet header for the correct NAT / PAT translation. However, with the development of the SIP standard, more reliable NAT mechanisms have appeared, for example, the Sport Rport field in the VIA header . All phones recommended by 3CX support the Rport field. The SIP ALG router function may undesirably modify the SIP VIA header by distorting the data set by the Rport extension. Therefore, we strongly recommend that you disable the SIP ALG or SIP Helper option, if present on your router. Familiarize yourself with the features of passing VoIP traffic through NAT / PAT translation .

System parameter “ALLOWSOURCEASOUTBOUND”

The ALLOWSOURCEASOUTBOUND system parameter is set in the 3CX Management Console in the Parameters section .

By default, it is 0 (off). If it is set to 1 (enabled), 3CX will use the IP address and port from the IP header of the packet (network layer) to register the remote telephone, and not from the Contact field of the SIP packet header (application layer). 3CX Media Server will also use the IP header data of the RTP (incoming media stream) packet to determine the address to which the outgoing media stream should be sent.

It is recommended to set the specified parameter if there are the following problems:

• Remote subscriber for double or triple NAT
• Remote Subscriber Does Not Support Rport Extension
• Remote subscriber sends incorrect registration information due to errors in his SIP stack
• The remote subscriber is connected in his network through a NAT router with SIP ALG enabled. This router incorrectly modifies the information in the SIP header. However, you do not have access to the remote router.

SIP port diversity in remote devices

If several remote devices are connected from the same network (LAN), and all the above methods do not solve the problem, you can try to assign your own, unique SIP port on each such device. For example, on the first device (telephone, gateway, etc.), set the SIP port 5060, on the second 5062, on the third 5064, etc. In some cases, after this device starts to work successfully.

Conclusion

Now you can see how competent planning and the correct operation of the network infrastructure are important for connecting remote users, and indeed the VoIP system as a whole. To summarize, once again we pay attention to the features of 3CX with remote connections:

• If the remote subscriber does not connect, or the sound does not pass from him - this is not a 3CX problem, this is a network infrastructure problem, in particular, WAN - LAN routing
• Try to simplify your infrastructure as much as possible and eliminate double and triple NAT translation
• Use recommended, proven firewalls and recommended 3CX SIP equipment
• Install the latest 3CX updates and the latest firmware on routers and SIP devices
• If possible, use 3CX Tunnel, which is used in all 3CX softphones, or 3CX SBC to remotely connect standard SIP phones

Repeat: 3CX supports remote direct SIP connections. Nevertheless, 3CX guarantees the correct operation of remote subscribers only if 3CX Tunnel technology is used. In all other cases, due to many factors beyond our control, it is impossible to guarantee a correct remote connection!