Migration guide for moving to a new server?

Hi all,

is there a migration guide for moving a FreePBX installation to a new server? The documentation in the wiki http://wiki.freepbx.org/display/FPG/Using+the+Backup+module seems to suggest that it is as easy as klicking some buttons. But it is not.

First Asterisk was not starting after reboot. “chkconfig asterisk” showed off for all runlevels. So I enabled it.

Next I can’t access the CDR reports and UCP. I got this error
Unable to connect to CDR Database using string:mysql:host=localhost;port=3306;dbname=asteriskcdrdb,freepbxuser,2c9d0b3530d0

The right password I found in /etc/freepbx.conf wich works with mysql on the command line. I replaced all occurrences of “2c9d0b3530d0” in all files in /etc/asterisk/ with the right one, but it still doesn’t work. Where else do I need to look?

Also, the Dashboard tells me that the “Phone Apps Daemon” and “UCP Daemon” are not running. Before I restored the backup from the old server everything was working as far as I can tell. I will look into that tomorrow.

I’m running FreePBX 10.13.66-11 with FreePBX Framework 13.0.115 on both servers.

The Backup & Restore module doesn’t really fills me with confidence. Who knows what else is not working… :frowning:

Thanks for your help

Have you checked the file cdr_mysql to verify the password

This is a common issue I have when doing restore jobs.

Sometimes restoring a backup will populate the CDR database fields in Advanced settings, there is an open ticket on this but i can’t find it at the moment. Just delete all the contents of fields in the section Remote CDR Database.

Yes I have. The odd thing was that there was only a cdr_mysql.conf.bak, so I renamed it. Still no luck.

Now I searched the asterisk database for “2c9d0b3530d0” and found it in the freepbx_settings table in the CDRDBPASS row. As I couldn’t find this setting anywhere in the GUI I changed it directly in the database and this error is gone now.

Next problem was the UCP and Phone Apps Daemon. I disabled both modules since I don’t have a license anyway and the errors are gone. But they were running on the old system. I wonder whether there is another underlaying problem.

Finally, the System Firewall is not running. I got the notification “Firewall Integrity Failed: Interface eth0 is not in the correct zone. This can be caused by manual alterations of iptables, or, an unexpected error. Please restart the firewall service.”

Uninstalling and reinstalling the Firewall Module solved that problem.

I think there should be a note in the Backup & Restore Module or in the wiki, that the module only works without problems when restoring to the same machine and when restoring to a new machine ,then certain steps are necessary.

Spoke too soon. After a reboot I get the same error regarding eth0 not being in the correct zone and the firewall is not running. After disabling and re-enabling the firewall the error is gone and the firewall runs (until the next reboot).

What should be the correct zone for eth0 (if this is really the error)? It is the only interface on this machine and is set to “Trusted”. After I disabled and re-enabled the firewall, eth0 is automatically set to “Internal” and everything works. When I reboot it is back to “Trusted” and when I try to set the zone to “Internal”, I lock myself out, even though my PC and the whole network is set to “Trusted”.

The server is only accessible from the LAN which is behind a NAT router. Do I need this firewall at all if it’s not exposed to the Internet? And why did the same configuration work on the old machine?

Here is the output of “iptables -L” after a reboot

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-FTP  tcp  --  anywhere             anywhere            multiport dports ftp 
fail2ban-apache-auth  tcp  --  anywhere             anywhere            multiport dports http 
fail2ban-SIP  all  --  anywhere             anywhere            
fail2ban-BadBots  tcp  --  anywhere             anywhere            multiport dports http,https 
fail2ban-SSH  tcp  --  anywhere             anywhere            multiport dports ssh 
fail2ban-recidive  all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-BadBots (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-FTP (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-SIP (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-apache-auth (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-recidive (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

and here after disabling/re-anabling

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fpbxfirewall  all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fpbx-rtp (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpts:ndmp:dnp 
ACCEPT     udp  --  anywhere             anywhere            udp dpts:terabase:hfcs-manager 

Chain fpbxattacker (3 references)
target     prot opt source               destination         
           all  --  anywhere             anywhere            recent: SET name: ATTACKER side: source 
LOG        all  --  anywhere             anywhere            LOG level warning prefix `attacker: ' 
DROP       all  --  anywhere             anywhere            

Chain fpbxblacklist (1 references)
target     prot opt source               destination         

Chain fpbxfirewall (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            udp spts:tcpmux:1024 state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             255.255.255.255     
ACCEPT     all  --  anywhere             anywhere            PKTTYPE = multicast 
ACCEPT     udp  --  anywhere             anywhere            udp spts:bootps:bootpc dpts:bootps:bootpc 
fpbx-rtp   all  --  anywhere             anywhere            
fpbxblacklist  all  --  anywhere             anywhere            
fpbxsignalling  all  --  anywhere             anywhere            
fpbxsmarthosts  all  --  anywhere             anywhere            
fpbxregistrations  all  --  anywhere             anywhere            
fpbxnets   all  --  anywhere             anywhere            
fpbxhosts  all  --  anywhere             anywhere            
fpbxinterfaces  all  --  anywhere             anywhere            
fpbxreject  all  --  anywhere             anywhere            
fpbxrfw    all  --  anywhere             anywhere            mark match 0x2/0x2 
fpbxlogdrop  all  --  anywhere             anywhere            

Chain fpbxhosts (1 references)
target     prot opt source               destination         
zone-trusted  all  --  localhost            anywhere            
zone-trusted  all  --  freepbx              anywhere            

Chain fpbxinterfaces (1 references)
target     prot opt source               destination         
zone-internal  all  --  anywhere             anywhere            

Chain fpbxknownreg (5 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            mark match 0x1/0x1 
fpbxsvc-ucp  all  --  anywhere             anywhere            
fpbxsvc-zulu  all  --  anywhere             anywhere            

Chain fpbxlogdrop (1 references)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain fpbxnets (1 references)
target     prot opt source               destination         
zone-trusted  all  --  192.168.99.4         anywhere            
zone-trusted  all  --  192.168.99.0/24      anywhere            

Chain fpbxregistrations (1 references)
target     prot opt source               destination         
fpbxknownreg  all  --  192.168.99.4         anywhere            
fpbxknownreg  all  --  192.168.99.254       anywhere            
fpbxknownreg  all  --  192.168.99.11        anywhere            
fpbxknownreg  all  --  sipgate.de           anywhere            
fpbxknownreg  all  --  sipgate.co.uk        anywhere            

Chain fpbxreject (1 references)
target     prot opt source               destination         
rejsvc-webrtc  all  --  anywhere             anywhere            
rejsvc-nfs  all  --  anywhere             anywhere            
rejsvc-smb  all  --  anywhere             anywhere            

Chain fpbxrfw (1 references)
target     prot opt source               destination         
           all  --  anywhere             anywhere            recent: SET name: REPEAT side: source 
           all  --  anywhere             anywhere            recent: SET name: DISCOVERED side: source 
fpbxattacker  all  --  anywhere             anywhere            recent: CHECK seconds: 10 hit_count: 50 name: REPEAT side: source 
fpbxattacker  all  --  anywhere             anywhere            recent: CHECK seconds: 86400 hit_count: 1 name: ATTACKER side: source 
fpbxshortblock  all  --  anywhere             anywhere            recent: CHECK seconds: 60 hit_count: 10 name: SIGNALLING side: source 
           all  --  anywhere             anywhere            recent: SET name: SIGNALLING side: source 
fpbxattacker  all  --  anywhere             anywhere            recent: CHECK seconds: 86400 hit_count: 100 name: REPEAT side: source 
ACCEPT     all  --  anywhere             anywhere            

Chain fpbxshortblock (1 references)
target     prot opt source               destination         
           all  --  anywhere             anywhere            recent: SET name: CLAMPED side: source 
LOG        all  --  anywhere             anywhere            LOG level warning prefix `clamped: ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain fpbxsignalling (1 references)
target     prot opt source               destination         
MARK       udp  --  anywhere             anywhere            udp dpt:sip MARK set 0x3 

Chain fpbxsmarthosts (1 references)
target     prot opt source               destination         
ACCEPT     all  --  sipgate.co.uk        anywhere            mark match 0x1/0x1 
ACCEPT     all  --  sipgate.de           anywhere            mark match 0x1/0x1 
ACCEPT     all  --  192.168.99.254       anywhere            mark match 0x1/0x1 
ACCEPT     all  --  sipconnect.sipgate.de  anywhere            mark match 0x1/0x1 

Chain fpbxsvc-chansip (0 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:sip 

Chain fpbxsvc-ftp (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp 

Chain fpbxsvc-http (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 

Chain fpbxsvc-https (2 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 

Chain fpbxsvc-iax (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:iax 

Chain fpbxsvc-isymphony (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:58080 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:55050 

Chain fpbxsvc-nfs (0 references)
target     prot opt source               destination         

Chain fpbxsvc-pjsip (0 references)
target     prot opt source               destination         

Chain fpbxsvc-provis (2 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:mit-ml-dev 

Chain fpbxsvc-restapps (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ctf 

Chain fpbxsvc-smb (0 references)
target     prot opt source               destination         

Chain fpbxsvc-ssh (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain fpbxsvc-tftp (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:tftp 

Chain fpbxsvc-ucp (4 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:81 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:vcom-tunnel 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:mcreport 

Chain fpbxsvc-vpn (3 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn 

Chain fpbxsvc-webrtc (0 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:radan-http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:8089 

Chain fpbxsvc-xmpp (3 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:xmpp-client 

Chain fpbxsvc-zulu (1 references)
target     prot opt source               destination         

Chain rejsvc-nfs (1 references)
target     prot opt source               destination         

Chain rejsvc-smb (1 references)
target     prot opt source               destination         

Chain rejsvc-webrtc (1 references)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere            tcp dpt:radan-http reject-with icmp-port-unreachable 
REJECT     tcp  --  anywhere             anywhere            tcp dpt:8089 reject-with icmp-port-unreachable 

Chain zone-external (0 references)
target     prot opt source               destination         
fpbxsvc-https  all  --  anywhere             anywhere            
fpbxsvc-ucp  all  --  anywhere             anywhere            
fpbxsvc-vpn  all  --  anywhere             anywhere            
fpbxsvc-xmpp  all  --  anywhere             anywhere            

Chain zone-internal (1 references)
target     prot opt source               destination         
fpbxsvc-ssh  all  --  anywhere             anywhere            
fpbxsvc-http  all  --  anywhere             anywhere            
fpbxsvc-https  all  --  anywhere             anywhere            
fpbxsvc-ucp  all  --  anywhere             anywhere            
fpbxsvc-iax  all  --  anywhere             anywhere            
fpbxsvc-isymphony  all  --  anywhere             anywhere            
fpbxsvc-provis  all  --  anywhere             anywhere            
fpbxsvc-vpn  all  --  anywhere             anywhere            
fpbxsvc-restapps  all  --  anywhere             anywhere            
fpbxsvc-xmpp  all  --  anywhere             anywhere            
fpbxsvc-ftp  all  --  anywhere             anywhere            
fpbxsvc-tftp  all  --  anywhere             anywhere            

Chain zone-other (0 references)
target     prot opt source               destination         
fpbxsvc-ucp  all  --  anywhere             anywhere            
fpbxsvc-provis  all  --  anywhere             anywhere            
fpbxsvc-vpn  all  --  anywhere             anywhere            
fpbxsvc-xmpp  all  --  anywhere             anywhere            

Chain zone-trusted (4 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

I have the same issue with the firewall. I disabled it and it stills says the trusted zone error. I dont need that firewall since my is behind my firewall in house and I dont have my box directly on the web.

Did you ever get these issues resolved? I have both CDR and Firewall issues.

Also have many issues with Backup & Restore. Files with wrong permissions/owners. Files generated wrong. Etc.

See post 4 for solving the CDR issue.

I switched off the firewall since my FreePBX sits behind a NAT router. But I have similar problems with another FreePBX installation which I didn’t migrate. So the problem might lay elsewhere and not with the migration to a new server.

Pretty much any permissions issue in FreePBX can be fixed by running:

fwconsole chown