The problem
The 3CX firewall test intermittently failed even though the PBX and public address were correct. Whitelisting a single IP only worked temporarily.
What I did
Packet and firewall evidence showed that pfBlockerNG GeoIP policy was blocking rotating alternate 3CX STUN reply addresses.
- Confirmed the PBX was not unintentionally routed through Proton VPN
- Identified reply traffic from changing STUN addresses and ports
- Created a narrowly scoped floating pass rule for the 3CX host
- Placed that pass rule above the pfBlockerNG GeoIP block rule
- Kept SIP/RTP handling on the firewall rather than attempting to proxy it through Pangolin
Implementation notes
Representative commands from the way I diagnose and maintain this project. Public examples use placeholders instead of credentials or sensitive addresses.
Firewall and STUN investigation
# Inspect active pfSense rules and NAT state
pfctl -sr
pfctl -sn
pfctl -ss | grep -E '3478|3479|5060|5090'
# Watch firewall decisions and STUN traffic
tcpdump -ni pflog0 host <3CX_IP>
tcpdump -ni wan udp portrange 3478-3479
# Confirm DNS and public reachability from the PBX side
getent ahostsv4 <STUN_HOST>
curl -4 https://ifconfig.coResult
The durable fix allows the rotating STUN replies while preserving the wider GeoIP block policy.