PORT5060 unencrypted, 5061 TLSIANA assigned
Ports 5060 and 5061SIP (VoIP signalling)
Port 5060 is the standard port for SIP, the signalling protocol that sets up VoIP calls, over UDP or TCP; port 5061 is SIP over TLS. The audio itself travels separately in RTP over a range of UDP ports. SIP servers exposed to the internet receive constant scanning for toll fraud.
What ports 5060 and 5061 are used for
SIP handles the signalling of a call: registering a phone with its server, inviting a party, negotiating codecs, putting a call on hold, hanging up. It does not carry the voice. Once both sides agree, audio flows directly in RTP over UDP ports chosen during the negotiation.
| Port | Protocol | Purpose |
|---|---|---|
| UDP/TCP 5060 | SIP | Plain signalling |
| TCP 5061 | SIP over TLS (SIPS) | Encrypted signalling |
| UDP range (e.g. 10000–20000) | RTP/RTCP | Audio and video |
Security considerations
Port 5060 on a public address is found by scanners such as SIPVicious within minutes. The goal is usually toll fraud: register as an extension or guess a trunk password, then place thousands of international calls.
- Never expose a PBX's 5060 to the internet without a session border controller or strict IP allow-lists for trunk providers.
- Strong, unique passwords per extension; disable guest/anonymous calling.
- Fail2ban or the PBX's own intrusion detection to block repeated registration failures.
- Use 5061 with TLS and SRTP for remote phones, or put them on a VPN.
- Restrict outbound dialling (international, premium rate) per extension and set spend limits with the trunk provider.
Checking
netstat -ano | findstr ":5060 :5061"On a PBX, the console shows registrations (sip show peers on Asterisk, or the FreePBX dashboard).
Firewall considerations
Allow inbound 5060/5061 only from SIP trunk provider addresses and from any SBC. Forward the RTP range only if remote phones must connect without a VPN, and pair it with the PBX's NAT settings.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 5060 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Why is there audio in only one direction?
NAT. SIP negotiates the RTP ports inside the message body, so the router does not know to open them. Fixes include a SIP ALG (often more harmful than helpful), STUN/ICE, a session border controller, or configuring the PBX with its public address and a fixed RTP range that is forwarded.
What is the difference between 5060 and 5061?
5061 is SIP over TLS. It protects the signalling (who is calling whom, credentials) but not the audio, which needs SRTP negotiated separately.