Provisioning Remote IP Phones in 3CX: Comparing Direct SIP with STUN versus 3CX SBC Tunneling

Overview

Key takeaways

• 3CX SBC multiplexes all SIP signaling and RTP media into a single encrypted TLS/UDP tunnel on port 5090.
• Direct SIP via STUN relies on public IP stability and unpredictable NAT port mapping, making it prone to unidirectional audio.
• 3CX SBC enables local PnP multicast discovery for remote IP phones, eliminating manual URL entry.
• STUN requires disabling SIP ALG and configuring complex port ranges on remote firewalls.
• 3CX v20 strongly favors SBC and Router Phone deployments over legacy STUN setups.

Prerequisites

• Administrative access to a 3CX PBX instance (v18 or v20).
• Supported remote IP phones (e.g., Yealink, Fanvil, Snom).
• Basic understanding of SIP, RTP, and NAT traversal concepts.

Guide

1. section #1

   Architecture Overview: Direct SIP/STUN vs. 3CX SBC

   Direct SIP and STUN Mechanism

   In a Direct SIP deployment, the remote IP phone communicates directly with the 3CX PBX across the public internet. The phone utilizes a STUN server (Simple Traversal of UDP through NAT) to discover its public IP address and external NAT port mappings, embedding these external addresses into its SIP headers.

   The 3CX SBC Tunnel Protocol

   The 3CX Session Border Controller (SBC) is a lightweight software agent installed on the remote local network or embedded inside a Router Phone. It package-bundles all remote SIP signaling and voice streams into a single, secure 3CX Tunnel connection back to the main PBX.

   • Direct SIP/STUN: Uses individual standard SIP ports (e.g., UDP 5060) and dynamic RTP audio port ranges (e.g., UDP 9000-10999) per phone.
   • 3CX SBC: Multiplexes all device traffic over a single TCP/UDP tunnel port (default 5090).
   textcopy

   Direct SIP (STUN):
   [IP Phone] --(SIP 5060 / RTP 9000+)--> [Remote Router NAT] --(Internet)--> [3CX PBX]
   
   3CX SBC Tunnel:
   [IP Phones] --(Local SIP/RTP)--> [3CX SBC / Router Phone] --(TLS Tunnel 5090)--> [3CX PBX]

2. section #2

   NAT Traversal and Media Path Routing

   Handling Public vs. Private IPs with STUN

   When an IP phone sits behind a remote NAT router using STUN, it continuously queries a public server to determine its mapped public address. If the router changes port mappings dynamically or enforces Symmetric NAT, the PBX receives mismatched address information, leading to failed calls or one-way audio.

   SBC Media Aggregation and Local Hairpinning

   The 3CX SBC resolves NAT complexity by keeping internal phone traffic isolated on the remote LAN. When two remote phones behind the same SBC call each other, the SBC performs local hairpinning to stream audio directly between the devices rather than sending media over the WAN.

   • STUN Media Routing: Every call sends voice packets up to the cloud PBX and back down, doubling internet bandwidth usage.
   • SBC Media Routing: Calls between local extensions stay on the LAN, conserving WAN bandwidth and reducing latency.
3. section #3

   Provisioning Workflows and Phone Discovery

   Manual MAC and RPS Provisioning via STUN

   Provisioning a remote phone via STUN requires manually adding the phone's MAC address to 3CX and binding it to a specific STUN port set. The device must then use the vendor's Redirection and Provisioning Service (RPS) or manual server URL entry to locate its configuration file upon boot.

   PnP Multicast Discovery via 3CX SBC

   When using a 3CX SBC or an integrated Router Phone, remote endpoints transmit standard PnP multicast packets across the local subnet. The SBC captures these requests and proxies them to the 3CX PBX, allowing administrators to provision remote phones instantly from the central dashboard.

   • Step 1: Connect the IP phone to the remote network hosting the 3CX SBC or Router Phone.
   • Step 2: Locate the bold PnP notification in the 3CX Management Console.
   • Step 3: Assign the detected MAC address to an extension; the SBC automatically delivers the configuration profile over HTTPS.
4. section #4

   Security, Encryption, and Firewall Requirements

   Open Ports and SIP ALG Risks in STUN

   Direct STUN setups require opening multiple firewall ports on the PBX side and disabling SIP ALG (Application Layer Gateway) on the remote router. Exposing raw SIP signaling directly to end-user networks increases susceptibility to SIP scanning and credential brute-forcing.

   TLS Encrypted Tunneling with 3CX SBC

   The 3CX SBC establishes an outbound TLS/SRTP tunnel to the central PBX, eliminating the need to open inbound ports on the remote network firewall. Because all control and media packets are encrypted within the tunnel, remote deployments remain secure against packet sniffing and unauthorized access.

   • Outbound-only tunnel architecture simplifies deployment across strict corporate firewalls.
   • Built-in TLS encryption protects SIP headers, extension passwords, and voice payloads.
   bashcopy

   # Example: Checking 3CX SBC service status on a remote Linux/Raspberry Pi host
   systemctl status 3cxsbc.service

5. section #5

   Selecting the Optimal Remote Deployment Strategy

   When to Use 3CX SBC or Router Phones

   Deploying a dedicated 3CX SBC software instance or utilizing a modern Router Phone (a desk phone running embedded SBC software) is the vendor-recommended best practice for all remote sites. It guarantees reliable provisioning, secure media delivery, and efficient bandwidth management across multi-phone environments.

   Legacy STUN Deployment Considerations

   STUN should be reserved strictly for single, standalone remote workers where installing an SBC host or replacing the desk phone with a Router Phone is impossible. Modern 3CX v20 releases have formally deprecated direct STUN configuration due to its inherent instability on residential networks.

   • SBC / Router Phone: Recommended for branch offices, multi-device home offices, and enterprise security compliance.
   • STUN / Direct SIP: Legacy method, constrained to single-phone home setups with predictable static NAT environments.

Further reading

• 3CX Documentation: Installing the 3CX Session Border Controller
• 3CX Guide: Configuring Router Phones for Remote Sites
• RFC 3489: STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs)
• 3CX Technical Reference: Firewall and Port Configuration Rules