Port 20000 RTP range end / Usermin · UDP

What runs on port 20000

The end of Asterisk's default RTP range (10000–20000 UDP), and also Usermin's port (the user side of Webmin) and the DNP3 industrial protocol. On a PBX, the RTP range carries the audio and must be open from the trunk provider and phones, otherwise calls connect with no sound.

Software that uses it: Asterisk / FreePBX (rtp.conf) · Usermin · DNP3 (SCADA)

Should port 20000 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• Narrow the RTP range to what you need (e.g. 10000–10999) and limit sources to your SIP provider and phone subnets.

Check port 20000

# on the host: is anything listening, and which process?
ss -lunp 'sport = :20000'
sudo lsof -i :20000

# from another machine: is it reachable?
nc -zuv host 20000
sudo nmap -sU -p 20000 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 20000

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 20000 proto udp
sudo ufw deny 20000/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 20000 accept
nft add rule inet filter input udp dport 20000 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 20000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 20000 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=20000 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 20000" with no source is just "open".

Related ports

• 10000 Webmin
• 5060 SIP — VoIP signalling

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions