Category Archives: FreePBX

FreePBX

How to Reset a FreePBX Administrator Password

If you forget your administrator login information for FreePBX, there is a simple way to log in and reset it. You will need your current root password to proceed with this tutorial.

  1. Log into your FreePBX server via SSH as the root user, using a tool such as PuTTY on Windows, or Terminal on Mac.
  2. Next, bring up your FreePBX web interface in a web browser. Once the page has loaded, press Ctrl + A on your keyboard to highlight everything on the page.
  3. Locate the unique session ID on the left side of the screen, and copy this string. It will look something like this: igg56njsp8bi0h4odqnupsq963
  4. In your PuTTY or terminal window, type the following (be sure to replace the unique string with your own, and press enter):
    [root@pbx ~]# fwconsole unlock igg56njsp8bi0h4odqnupsq963

    Unlocking:

    session unlocked!

    [root@pbx ~]#

    If you are using FreePBX 13 or earlier and the above gives you a ‘command not found’ error message, use the deprecated amportal command:

    [root@pbx ~]# amportal a u igg56njsp8bi0h4odqnupsq963

    Fetching FreePBX settings with gen_amp_conf.php..

    session unlocked!

    [root@pbx ~]#

  5. In your web browser, refresh the login page and you will be automatically logged in.
  6. Visit Admin -> Administrators and select your user on the right side of the page. At this point, you can reset your password.
Computer, DNS, firewall, FreePBX, IT, Linux, sysadmin

DHCP Options in Plain English

DHCP Options in Plain English

Published on 18 May 2013

The following tables list common, configurable DHCP options. Non-configurable options or TLVs have not been included, even though these may be present in a file or on the wire. The following tables also do not include options that are only necessary for the operation of the DHCP protocol. For example, DHCPv4 option 53 is the DHCP message type option that declares whether a particular message is a discovery, request, or other message type. However, the administrator can’t configure this option, so therefore it isn’t included in the lists below.
Of course, there will be some DHCPv4, DHCPv6, and internal DHCP options that are not listed at all. This is because this document aims to act as a guide for the most commonly-used options only. For further information on other DHCP options, refer to the IETF website.

Table 1 – DHCPv4 Options

The table below describes DHCP options commonly used in IPv4 networks. Please note: Certain classes of devices will use particular subsets, as listed below:

  • Cable Modems: 1, 2, 3, 4, 6, 7, 51, 66, 67, 122.1, 122.2
  • MTAs: 1, 2, 3, 4, 6, 7, 51, 122.3, 122.6.  If in BASIC mode, also 66, 67
  • Generic devices: 1, 3, 6, 51
Option Number Option Name Source Description
1 Subnet Mask RFC 2132 The subnet mask to apply to the address that is assigned to the client.
2 Time Zone Offset RFC 2132 Informs the client about the time zone offset, in seconds.  For example, Pacific Standard Time is GMT – 8 hours.  This field would be filled with “- 28800”.  (Eight hours * 60 minutes/hour * 60 seconds/minute)
3 Gateway RFC 2132 Tells the client which router is the default router.
4 Time Server RFC 2132 Tells the client the IP address of a time server that can determine the client’s current time. This is related to the Time Zone Offset option.
6 Domain Name Server RFC 2132 Carries the IP address(es) of the DNS servers that the client uses for name resolution.
7 Log Server RFC 2132 Carries the IP address of the syslog server that receives the client’s log messages.
12 Hostname RFC 2132 Carries the hostname portion of a client’s fully qualified domain name (FQDN). For example, the “www” part of “www.example.com”.
15 Domain Name RFC 2132 Carries the domain name portion of a client’s fully qualified domain name (FQDN).  For example, the “example.com” portion of “www.example.com”.
43 Vendor Specific Information RFC 2132 Carries some configuration data that is not defined in the standard DHCP RFCs.  Individual vendors can define different pieces of data that may be found in this option. CableLabs’ eDOCSIS specification, for example, defines certain sub-options that appear in this option.
51 Lease Time Option RFC 2132 This defines the maximum amount of time that the client may use the IP address.
60 Vendor Class Identifier RFC 2132 Carries some identifier from the client that may identify the client’s device class. The DHCP specification does not define what values go into this field, but other specifications do. For example, the DOCSIS specifications state that if the device is DOCSIS-compliant, option 60 must start with “docsis” (and also include other details).
66 TFTP Server Name RFC 2132 Carries the FQDN or IP address (or cluster identifier) that the device should use to download the file specified in option 67.  Note that often the data put into option 66 does not actually appear in the DHCP packet as option 66, but may have been moved into the “sname” field of the DHCP packet.  Additionally, the FQDN may have been resolved to an IP address and also placed in the “siaddr” field of the DHCP packet.
67 Filename RFC 2132 Carries the filename that is to be downloaded from the server specified in option 66. Note that often data put into option 67 does not actually appear in the DHCP packet as option 67, but may be moved into the “file” field of the DHCP packet.  (Note: Address Commander can do some dynamic file name generation for this name.)
82 Relay Agent Information Option RFC 3046 This option carries many other sub-options that are added by relay agents and not the clients themselves.  Some of the common options are listed below.
82.1 Circuit ID RFC 3046 This is an identifier added by the relay agent to indicate which interface the client is on. This is commonly used as a subscriber identifier in DSL-based networks.
82.2 Remote ID RFC 3046 This is an identifier added by the relay agent to identify the client. It is commonly used as a subscriber identifier in DOCSIS-based networks.  DOCSIS mandates that this option is filled with the MAC address of the cable modem and applies to all traffic from the cable modem, or any device appearing from behind that cable modem.
122 CableLabs Client Configuration Option RFC 3495 This is an option defined by CableLabs to carry the information necessary to configure PacketCable devices. The sub-options are listed below.
122.1 TSP Primary DHCP Server RFC 3495 The multimedia telephony adapter (MTA) portion of the device listens to this IP address of the DHCP server. This has two special values, 0.0.0.0 (which will disable the MTA), and 255.255.255.255 (which will instruct the MTA to accept replies from any DHCP server).
122.2 TSP Secondary DHCP Server RFC 3495 A second DHCP server’s IP address.  Otherwise the same as option 122.1
122.3 TSP Provisioning Server’s Address RFC 3495 The MTA contacts the server listed to complete its provisioning process. This is the FQDN of a multimedia provisioning service (MPS), whether a specific MPS, or a cluster identifier.
122.6 TSP Kerberos Realm Name RFC 3495 For PacketCable secure mode provisioning, the name of the Kerberos Realm. There are four more special values that may be in this field: BASIC.1, BASIC.2, HYBRID.1, and HYBRID.2.  This indicates whether the device is in basic, hybrid, or secure mode provisioning. The “.1” and “.2” parts indicate whether the MTA notified the provisioning server upon completion of the provisioning process.

 

Table 2: DHCPv6 Options

The table below describes DHCP options commonly used in IPv6 networks.

Option Number Option Name Source Description
17 Vendor Specific Information Option RFC 3315 This option contains vendor-specific option data, much like DHCPv4 option 43.  There is an extra difference in that in DHCPv6, this option carries a vendor ID as well, which allows for data from multiple vendors to be provided to the device.
17[4491] CableLabs Vendor-Specific Information Option CL-SP-CANN-DHCP-Reg-I08-111117 CableLabs has specified a set of sub-options for use with DOCSIS-compliant DHCPv6 devices.  The vendor ID for CableLabs is 4491.
17[4491].32 TFTP Server Addresses option CL-SP-CANN-DHCP-Reg-I08-111117 This is a list of IPv6 addresses that the client will use to try to download its boot file (specified in 17[4491].33) using TFTP.
17[4491].33 Configuration File Name CL-SP-CANN-DHCP-Reg-I08-111117 The name of the file to download using the TFTP servers specified in 17[4491].32.
17[4491].34 Syslog Server Addresses CL-SP-CANN-DHCP-Reg-I08-111117 This is the DHCPv6 analogue to the DHCPv4 option 7.
17[4491].37 RFC868 Servers CL-SP-CANN-DHCP-Reg-I08-111117 This is the DHCPv6 analogue to the DHCPv4 option 4
17[4491].38 Time Offset CL-SP-CANN-DHCP-Reg-I08-111117 This is the DHCPv6 analogue to the DHCPv4 option 2.
23 DNS Recursive Name Server Option RFC 3646 This is the DHCPv6 analogue to the DHCPv4 option 6.
24 Domain Search List RFC 3646 This option specifies the list of domain names that the client should use when attempting to resolve basic host names.
39 DHCPv6 FQDN option RFC 4704 This option specifies the clients host and domain names. This is the analogue of both DHCPv4 option 12 and DHCPv4 option 15 combined. 

References

RFC 2132: http://datatracker.ietf.org/doc/rfc2132/
RFC 3046: http://datatracker.ietf.org/doc/rfc3046/
RFC 3495: http://datatracker.ietf.org/doc/rfc3495/
RFC 3646: http://datatracker.ietf.org/doc/rfc3646/
RFC 4704: http://datatracker.ietf.org/doc/rfc4704/
CL-SP-CANN-DHCP-Reg-I08-111117: http://www.cablelabs.com/specifications/CL-SP-CANN-DHCP-Reg-I08-111117.pdf

Source: DHCP Options in Plain English – Incognito Software

FreePBX, sysadmin

Ports used on your PBX – PBX Platforms – Documentation

The table below outlines all the ports used on your PBX that you need to open on your hardware firewall if you want outside users to have access to things. These are default port assignments for new installs, but most can be changed by the user post install. Legacy versions may have used different default port numbers (notably http provisioning) and the original port numbers remain unaffected when the system is upgraded.

 

PBX Admin Access

PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
22 TCP SSH Console This can only be changed inside from inside Linux CLI and not recommended to be changed. Not recommended to open this up to untrusted networks. Port used to allow SSH to the PBX from the outside world.
80 FreePBX

2001 PBXact

 TCP PBX GUI HTTP (Non HTTPS) Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Not recommended to open this up to untrusted networks. Used to access the PBX Admin GUI
443 TCP PBX GUI HTTPS Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Not recommended to open this up to untrusted networks. Used to access the PBX Admin GUI with SSL encryption
1194 TCP/UDP OpenVPN server Change not supported Can open to untrusted hosts Used to connect OpenVPN clients to PBX VPN Server.

 

PBX SIP and IAX Communication

PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
5060 UDP chan_PJSIP Signaling Can change this port inside the PBX Admin GUI SIP Settings module. Not recommended to open this up to untrusted networks. Standard Port used for chan_PJSIP Signalling.
5061 chan_PJSIP
Secure Signaling		 Can change this port inside the PBX Admin GUI SIP Settings module. Not recommended to open this up to untrusted networks. Secure Port used for chan_PJSIP Signalling.
5160 UDP chan_SIP Signaling Can change this port inside the PBX Admin GUI SIP Settings module. Not recommended to open this up to untrusted networks. Standard Port used for chan_SIP Signalling.
5161 chan_SIP
Secure Signaling		 Can change this port inside the PBX Admin GUI SIP Settings module. Not recommended to open this up to untrusted networks. Secure Port used for chan_SIP Signalling.
10000-20000 UDP RTP for SIP Can change this port inside the PBX Admin GUI SIP Settings module. Safe to open to the outside world and is required by most SIP Carriers as your RTP traffic can come from anywhere. Used for the actual voice portion of a SIP Call.
4569 UDP IAX Can change this port inside the PBX Admin GUI IAX Settings module. Not recommended to open this up to untrusted networks. Used for IAX protocol and trunking
4000-4999 UDP FAX UDPTL Not configurable in the GUI, on by editing custom conf file. Used for T38 fax media

PBX User Control Panel (UCP)

PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
81 TCP PBX User Control Panel (UCP) HTTP (Non HTTPS) Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS version of PBX User Control Panel instead for remote users. Port used to access the GUI portion of UCP
4443 TCP PBX User Control Panel (UCP) HTTPS Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Safe to open this up to untrusted networks as the traffic is encrypted and requires username and password authentication. Port used to access the GUI portion of UCP with SSL encryption
8088 TCP WebRTC Unencrypted Softphone Client Can change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTP Bind Port Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS version Used for the WebRTC portion of UCP
8089 TCP WebRTC Encrypted Softphone Client Can change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTPS Bind Port Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication. Used for the WebRTC portion of UCP
8001 TCP Node Server Can change this port inside the PBX Admin GUI > Advanced Settings > UCP NodeJS Server > NodeJS Bind Port Not recommended to open this up to untrusted networks as the traffic is not encrypted. Used by UCP with HTTP for Conf Rooms and Chatting and other products in UCP
8003 TCP Node Server (secure) Can change this port inside the PBX Admin GUI > Advanced Settings > UCP NodeJS Server > NodeJS HTTPS Bind Port Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication. Used by UCP with HTTPS for Conf Rooms and Chatting and other products in UCP

PBX Phone Provisioning and Phone Apps

PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
84 TCP HTTP Provisioning for Phones (Non HTTPS) Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS Phone Provisioning option of instead for remote users. Make sure if opening up outside access to enable username and password authentication for HTTP provisioning from the PBX Admin GUI System Admin > Provisioning Protocol. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning. In the past, http provisioning defaulted to port 83. When upgrading older systems, the port assignments to not change from their original settings.
1443 TCP HTTPS Provisioning for Phones Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Safe to open this up to untrusted networks as the traffic is encrypted as long as your enable username and password authentication as outlined in the Notes section. Make sure if opening up outside access to enable username and password authentication for HTTP provisioning from the PBX Admin GUI System Admin > Provisioning Protocol. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning.
21 TCP FTP Provisioning for Phones This can only be changed inside from inside Linux CLI and not recommended to be changed. Not recommended to open this up to untrusted networks as it has no ability encrypt traffic and is not NAT Friendly. Recommend using HTTPS provisioning for remote phones instead. Used if your are having phones inside EPM use TFTP for provisioning. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning.
69 UDP TFTP Provisioning for Phones This can only be changed inside from inside Linux CLI and not recommended to be changed. Not recommended to open this up to untrusted networks as it has no ability encrypt traffic and is not NAT Friendly. Used if your are having phones inside EPM use TFTP for provisioning. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning.
82 TCP Phone Apps HTTP (Non HTTPS) Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using Phone Apps HTTPS option of instead for remote users. Port used for phone apps to communicate with the PBX as HTTP not HTTPS traffic. Inside EPM you pick if the phone apps use HTTP or HTTPS.
3443 TCP Phone Apps HTTPS Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section. Safe to open this up to untrusted networks as the traffic is encrypted. Port used for phone apps to communicate with the PBX using SSL encryption. Inside EPM you pick if the phone apps use HTTP or HTTPS.

Zulu 3

 

PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
8002 TCP Zulu 3 Client Communication with PBX Can change this port inside the PBX Admin GUI > Advanced Settings > Zulu Section > Zulu Bind Address Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication. Used for signalling
10000-20000 UDP Media – RTP The port can be changed by going to Settings → Asterisk SIP Settings → General SIP Settings Tab. Note: Zulu uses the same rtp port configuration as SIP. Safe to open this up to untrusted networks, as your RTP traffic can come from anywhere your Zulu users are connecting from. Used for handling media during a call

Zulu 2

PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
PORT
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
8002 TCP Zulu 2 Client Communication with PBX Can change this port inside the PBX Admin GUI > Advanced Settings > Zulu Section > Zulu Bind Address Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication. Zulu 2.0 requires this and the ports below to be opened. NOTE: You may require the “RTP for SIP” port range to be open as well, for call audio.
8088 TCP Zulu 2.0 Unencrypted Softphone Client Can change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTP Bind Port If using Zulu 3.0 this port should not be open. Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS version Used for the softphone portion of Zulu
8089 TCP Zulu 2.0 Encrypted Softphone Client Can change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTPS Bind Port If using Zulu 3.0 this port should not be open. Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication. Used for the softphone portion of Zulu
5000 TCP Zulu 2.0 Chat At this time can not change the port If using Zulu 3.0 this port should not be open. Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication. Used for chat portion of Zulu

 

RMS Monitoring

PORTS
TCP/UCP
PURPOSE
CHANGING PORT
SECURITY
NOTES
443
5071
4505 4506		 TCP
Outbound		 Checks
Metrics
RPC		 N/A RMS only uses these ports for outbound connections.
Thus, no INBOUND firewall rule changes are necessary.		 If the firewall is configured to block outbound ports/connections, then these ports need to be added to the allowed outbound port list.

Source: Ports used on your PBX – PBX Platforms – Documentation

FreePBX

Installation: Pear problem – FreePBX / Installation – FreePBX Community Forums

In case someone else happens across this question through a search it appears that there is a missing step depending upon how PEAR was originally installed (I just used the pkg available on Ubuntu). In order to fix this the PEAR DB must be installed/initialized:#pear install DBdownloading DB-1.7.13.tgz …Starting to download DB-1.7.13.tgz (132,246 bytes)…done: 132,246 bytesinstall ok: channel://pear.php.net/DB-1.7.13Just that simple! That should get you over the hump.

Source: Installation: Pear problem – FreePBX / Installation – FreePBX Community Forums