Port reference
Port 1720 (TCP) – H.323 (VoIP call signaling)
H.323 call setup channel (Q.931 over TCP) — the legacy signaling protocol for VoIP and video conferencing endpoints and gatekeepers.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on H.323 gateways, gatekeepers, IP-PBXs, and video conferencing units (Cisco, Avaya, Polycom). Sometimes exposed to the internet for inter-site trunks.
What is port 1720 used for?
Port 1720 carries H.323 call signaling, the channel used to set up VoIP and video-conferencing calls. H.323 is the older ITU-T telephony standard found on gateways, IP-PBXs, and conferencing units from vendors like Cisco, Avaya, and Polycom. It handles the call setup while the audio and video themselves flow over RTP. Many newer systems have moved to SIP (port 5060) instead.
When would you open it?
Open or forward 1720 only if you operate H.323 equipment that must connect across networks — for instance a SIP/H.323 trunk between sites or to a telephony provider. For most internal deployments the devices talk to each other on the LAN and the port need not face the internet.
Is it safe to open?
An exposed H.323 gateway can be abused for toll fraud, so keep it behind a session border controller or VPN, require gatekeeper authentication, and restrict which IPs can connect. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1720
nmap -p 1720 <target>netstat -ano | findstr :1720
Test-NetConnection <host> -Port 1720lsof -i :1720
nmap -p 1720 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1720 to your device's local IP, internal port 1720, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1720/tcpsudo firewall-cmd --permanent --add-port=1720/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1720 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1720" -Direction Inbound -Protocol TCP -LocalPort 1720 -Action AllowSecurity & risks
Common attacks
- Endpoint and gatekeeper enumeration
- Toll fraud through unauthenticated call setup
- Q.931/H.225 fuzzing causing crashes or denial of service
- Call interception and signaling manipulation
Hardening
- Do not expose H.323 directly — front with an SBC or VPN
- Require gatekeeper registration and authentication for endpoints
- Restrict source IPs for trunks and inter-site links
- Patch gateway/endpoint firmware against H.225/Q.931 parsing flaws
- Prefer modern SIP/TLS where possible and retire legacy H.323
How to block this port
sudo ufw deny 1720/tcpsudo firewall-cmd --permanent --remove-port=1720/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1720 -j DROPNew-NetFirewallRule -DisplayName "Block 1720" -Direction Inbound -Protocol TCP -LocalPort 1720 -Action Blocknmap snippet
nmap -p1720 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between H.323 and SIP?
- Both are VoIP signaling protocols. H.323 (port 1720) is the older ITU standard built on Q.931/H.225, while SIP (port 5060) is the simpler, text-based IETF standard that has largely replaced it. Many deployments now migrate H.323 to SIP.
- Why is port 1720 a toll fraud risk?
- An H.323 gateway that accepts unauthenticated call setup lets attackers route outbound calls to premium-rate numbers at the victim's expense, the same monetization seen on SIP 5060.