Port 5061 SIP over TLS · TCP

What runs on port 5061

SIP over TLS (SIPS): encrypted signalling. Pair with SRTP for the media or the call content is still in the clear. Microsoft Teams Direct Routing, most SIP trunk providers and modern desk phones support it.

Software that uses it: Asterisk / FreePBX · FreeSWITCH · Kamailio · Teams Direct Routing SBCs · Cisco CUCM

Should port 5061 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• TLS does not fix toll fraud; the password policy does.

Check port 5061

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :5061'
sudo lsof -i :5061

# from another machine: is it reachable?
nc -zv host 5061
nmap -p 5061 host
curl -v telnet://host:5061      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 5061

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 5061 proto tcp
sudo ufw deny 5061/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 5061 accept
nft add rule inet filter input tcp dport 5061 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 5061 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5061 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=5061 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 5061" with no source is just "open".

Related ports

• 5060 SIP — VoIP signalling
• 3478 STUN / TURN — WebRTC NAT traversal

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions