SIP, PBX and UC port reference: what to open, what to never expose

Signalling ports

SIP signalling carries registration and call setup. Encrypted signalling on TLS is the default we deploy; plain UDP signalling is restricted to carrier address ranges only.

• 5060/UDP and 5060/TCP — plain SIP. Restrict to carrier ranges and known office networks; never leave open to the world.
• 5061/TCP — SIP over TLS. The correct transport for remote and mobile users.
• 5090/TCP and vendor-specific tunnel ports — used by 3CX and similar tunnelling clients instead of open SIP.
• IAX2 4569/UDP — only where legacy inter-server trunks genuinely require it.

Media ports

Media travels separately from signalling. If signalling succeeds but audio does not flow, the RTP range or the NAT configuration is almost always the cause.

• 10000-20000/UDP — the default RTP range on Asterisk, FreePBX and Issabel. Narrow it to the concurrent call count you actually need.
• 9000-10999/UDP — the default 3CX media range.
• SRTP uses the same ranges; encryption changes the payload, not the port behaviour.
• Disable SIP ALG on every edge device in the path; it rewrites headers and produces symptoms that look like PBX faults.

Management and adjacent services

Management interfaces are the ports most often left exposed by accident and are the ones that cause incidents.

• Web administration, SSH, AMI (5038) and database ports must be reachable only over VPN or a restricted management network.
• Provisioning and firmware endpoints should be served over HTTPS with per-device credentials, not anonymous HTTP.
• Monitoring and alerting should reach the platform inbound-restricted, not by opening the platform outward.

Mail and infrastructure ports worth pinning down

Voicemail-to-email, alerting and backup jobs quietly depend on these, and they break silently after a firewall change.

• 587/TCP submission with authentication for outbound notifications; port 25 outbound is frequently blocked by hosting providers.
• 443/TCP for cloud backup targets and management agents.
• 53/UDP and 53/TCP to controlled resolvers only, with DNS filtering applied.