Port 5060 SIP · TCP and UDP

What runs on port 5060

SIP signalling for VoIP: registration, call setup and teardown, with the audio itself in RTP on a separate UDP range (10000–20000 in Asterisk by default). Plaintext on 5060; SIP over TLS on 5061. Internet-facing SIP is scanned continuously by toll-fraud bots (friendly-scanner, sipvicious) looking for extensions with weak passwords to place premium-rate calls.

Software that uses it: Asterisk / FreePBX · FreeSWITCH · Kamailio, OpenSIPS · 3CX · SIP phones and ATAs · Twilio, Zadarma and other SIP trunks

Should port 5060 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• fail2ban with the asterisk jail, strong per-extension secrets and "permit/deny" per peer are the minimum; a SBC is better.
• NAT is the usual cause of one-way audio: the RTP range must be open and the PBX must know its external address.

Check port 5060

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :5060'
ss -lunp 'sport = :5060'
sudo lsof -i :5060

# from another machine: is it reachable?
nc -zv host 5060
nmap -p 5060 host
nc -zuv host 5060
sudo nmap -sU -p 5060 host
curl -v telnet://host:5060      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 5060

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 5060 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 5060 proto udp
sudo ufw deny 5060/tcp
sudo ufw deny 5060/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 meta l4proto { tcp, udp } th dport 5060 accept
nft add rule inet filter input meta l4proto { tcp, udp } th dport 5060 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 5060 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5060 -j DROP
iptables -A INPUT -p udp --dport 5060 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=5060 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 5060" with no source is just "open".

Related ports

• 5061 SIP over TLS
• 3478 STUN / TURN — WebRTC NAT traversal
• 10000 Webmin

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions