Specifications

Firewall&RouterConfiguration
Introduction
Undoubtedly, the best place for 3CX Phone System is on a machine behind a firewall. This
configurationiseasierandmore secure. If youonlyusePSTNlinesanddonotplan to have any
remoteextensions,youdon’tevenneedtomakeanychangestoyourfirewallconfiguration.
However,ifyouplantouseremoteextensionsoraVoIPProvider,youwillhavetomakechangesto
yourfirewallconfiguration.Inorderfor3CXPhoneSystemtocommunicatesuccessfullywithVoIP
providersandRemoteExtensions,yourfirewall/routerdevicemustbe correctlyconfiguredforSIP
operation.
YoucanlearnmoreaboutVoIPandFirewallsinthisarticle:http://www.3cx.com/blog/voip
howto/firewallnatpatstun/
SIPALG
Tomaximizeyourchancesofsuccess,makesureyouchooseadevicethatdoesnotimplementa
SIPHelperorSIPALG(ApplicationLayerGateway),orchooseadeviceonwhichSIPALGcanbe
disabled.ThefollowinglinksareexampleshowtoswitchoffALGonpopularrouters:
● HowtoDisableSIPALGonFortinet/FortiGate
● HowtoDisableSIPALGonNetgearRouters
● HowtoDisableSIPALGonThomsonRouters
ConfigurationforVoIPproviderorSIPTrunk
If you intend to use a VoIP Provider & the 3CX WebRTC Gateway  you will need to open the
followingportstoallow3CXPhoneSystemtocommunicatewiththeVoIPProvider:
● Port5060(UDP)forSIPcommunications(send&receive)MUSTBESTATICALLY
MAPPED.Seesamplefirewallconfigurationathttp://www.3cx.com/blog/voiphowto/linksys
routerconfiguration/
● Port5061(TCP)forTLScommunications–IfusingsecureSiP.
● Port90009199(orhigher)(UDP)(send&receive)forRTPcommunications,whichcontain
theactualcall.Eachcallrequires2RTPports,onetocontroltocallandoneforthecalldata.
Therefore,youmustopentwiceasmanyportsasyouwishtosupportsimultaneouscallsvia
the VoIP provider. For example, if you want to allow 4 people to make calls via the VoIP
providersimultaneously,youmustopenport9000to9007.
Notethattheaboveportrangesarethedefaultportsin3CXPhoneSystem.Youcanadjustthese
portsfromthe3CXManagementConsole,inthe“Settings”>“Network”node.Fromthisnode,
youcanconfiguretheportstobeusedforinternalcalls,andtheportstobeusedforexternalcalls
beingmadeviaaVoIPproviderorcallstoandfromaremoteextension.