Port reference
Port 5060 (TCP/UDP) – SIP (VoIP)
Session Initiation Protocol — the signaling protocol that sets up, manages, and tears down VoIP calls.
Quick facts
- Transport
- tcp, udp
- Category
- Registered
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on VoIP PBXs, SIP trunks, and IP phones (Asterisk, FreePBX, FreeSWITCH). Often exposed to the internet for remote extensions and trunks.
What is port 5060 used for?
Port 5060 carries SIP (Session Initiation Protocol), the protocol that sets up, manages, and ends VoIP phone calls. It registers IP phones, places and routes calls, and negotiates the media session (the actual audio then flows over RTP). It runs on UDP and TCP 5060 in plain text; the encrypted version, SIP over TLS, uses 5061. Phone systems like Asterisk, FreePBX, FreeSWITCH, and 3CX, plus desk IP phones and softphones, all use it.
When would you open it?
Open or forward port 5060 when you run a VoIP PBX or SIP server and need remote phones or a SIP trunk provider to connect. If your provider or PBX handles registration outbound, you often don't need to open it inbound at all.
Is it safe to open?
Exposed SIP is heavily scanned for toll fraud and password-guessing. Front it with a Session Border Controller or VPN, use strong per-extension passwords, and prefer SIP over TLS on 5061. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5060
nmap -p 5060 <target>netstat -ano | findstr :5060
Test-NetConnection <host> -Port 5060lsof -i :5060
nmap -p 5060 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5060 to your device's local IP, internal port 5060, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5060/tcpsudo firewall-cmd --permanent --add-port=5060/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5060 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5060" -Direction Inbound -Protocol TCP -LocalPort 5060 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Toll fraud — placing fraudulent premium-rate calls
- Registration hijacking and extension takeover
- Credential brute force and SIP user/extension enumeration
- INVITE/REGISTER flooding for denial of service
Hardening
- Do not expose SIP directly — front with an SBC or VPN
- Enforce strong, unique SIP secrets and reject easy enumeration
- Use SIP over TLS (5061) and SRTP for media encryption
- Rate-limit registrations/INVITEs and use fail2ban against brute force
- Restrict source IPs for trunks and set per-extension call limits/allowed destinations
How to block this port
sudo ufw deny 5060/tcpsudo firewall-cmd --permanent --remove-port=5060/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5060 -j DROPNew-NetFirewallRule -DisplayName "Block 5060" -Direction Inbound -Protocol TCP -LocalPort 5060 -Action Blocknmap snippet
nmap -p5060 -sU --script sip-methods,sip-enum-users <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is port 5060 targeted so heavily?
- Compromising a SIP server enables toll fraud — attackers place expensive premium-rate calls on the victim's account. Open 5060 is constantly scanned and brute-forced by automated VoIP fraud tools.
- Should SIP use TCP or UDP?
- Both are valid; SIP traditionally uses UDP 5060 but also runs over TCP. For security, prefer SIP over TLS on 5061 so signaling and credentials are encrypted.