3cx - ports not match

[jensl]

HELLO,

I have a freshley installated 3CX on an hyper-v (Debian install). bevor that is an opnsense, that should be configured like this:
[URL unfurl="true"]https://www.3cx.com/docs/pfsense-firewall/[/URL]

sadly i get the following errors when running the firewall check of the 3cx
testing port 5090... Mapping does not match 5090. Mapping is 15454. (How to resolve?)
testing ports [9000..9398]... failed (How to resolve?)
testing port 9000... Mapping does not match 9000. Mapping is 37427. (How to resolve?)
testing port 9002... Mapping does not match 9002. Mapping is 3031. (How to resolve?)
testing port 9004... Mapping does not match 9004. Mapping is 50285. (How to resolve?)
testing port 9006... Mapping does not match 9006. Mapping is 59049. (How to resolve?)
testing port 9008... Mapping does not match 9008. Mapping is 45467. (How to resolve?)
testing port 9010... Mapping does not match 9010. Mapping is 49269. (How to resolve?)
does anyone have any idea where i can look for further help?
i usuing an fibre connection with multiple ip adresses (the second one is used for the 3cx) and an cable connection for the normal internet.
the dns is running on an active directory and is configured for split dns.

[meyergru]

Configure an outbound NAT rule with "static port" enabled for the 3CX IP placed before normal outbound NAT rules. Otherwise, ports will get mapped arbitrarily.

BTW: You are certainly aware of the latest security problems of 3CX?

[jensl]

hey,
yeah i create an outbound rule - not quite sure if there is any option to put it "before" other rules?
change the mode to hybrid

(i did.... produced me quite some work the last week, but seems like they used it as an wakeup call and changed finally some other problems too)

[meyergru]

I assume you only have one public IPv4 (You do actually have one, do you? This is not a CGNAT line?), so with that, you need a NAT rule for your LAN devices anyway.

So, in order to match your 3CX server before it hits that general outbound NAT rule without "static port" enabled, as is usual for any non-VoIP device, you need order your rules such that the one for the 3CX server is above/before that general LAN NAT rule.

But maybe I am wrong, as you did not provide a clear layout of what you have before you.