Port reference
Port 5061 (TCP) – SIP over TLS
SIP (Session Initiation Protocol) signaling encrypted with TLS for secure VoIP call setup.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on VoIP servers and PBXes (Asterisk, FreeSWITCH, Kamailio) configured for SIP-TLS. The encrypted counterpart to plaintext SIP on 5060.
What is port 5061 used for?
Port 5061 carries SIP (Session Initiation Protocol) signaling encrypted with TLS, the secure version of plaintext SIP on port 5060. It sets up, modifies, and ends voice and video calls for VoIP systems. PBX and softswitch software such as Asterisk, FreeSWITCH, and Kamailio use it, as do IP phones and SIP trunking providers that require encrypted call setup.
When would you open it?
Open or forward port 5061 only if you run a SIP server or PBX that accepts encrypted SIP connections from remote phones, branch offices, or an upstream VoIP carrier. Most home and office users never need it, since calls go out through the provider rather than into your network.
Is it safe to open?
Exposing SIP invites toll-fraud attempts against weak accounts, so use strong credentials and restrict access to known IPs. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5061
nmap -p 5061 <target>netstat -ano | findstr :5061
Test-NetConnection <host> -Port 5061lsof -i :5061
nmap -p 5061 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5061 to your device's local IP, internal port 5061, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5061/tcpsudo firewall-cmd --permanent --add-port=5061/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5061 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5061" -Direction Inbound -Protocol TCP -LocalPort 5061 -Action AllowSecurity & risks
Common attacks
- SIP user/extension enumeration to find valid accounts
- Credential brute force leading to toll fraud
- Downgrade attempts to plaintext SIP on 5060
- Exploiting weak TLS configuration or expired certificates
Hardening
- Enforce TLS with strong ciphers and valid certificates
- Use strong SIP credentials and disable guest/anonymous calls
- Restrict source IPs and rate-limit registration attempts
- Disable plaintext SIP on 5060 where TLS is required
- Patch the PBX/SIP stack and monitor for enumeration
How to block this port
sudo ufw deny 5061/tcpsudo firewall-cmd --permanent --remove-port=5061/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5061 -j DROPNew-NetFirewallRule -DisplayName "Block 5061" -Direction Inbound -Protocol TCP -LocalPort 5061 -Action Blocknmap snippet
nmap -p5061 --script sip-methods,ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between 5060 and 5061?
- 5060 carries plaintext SIP signaling; 5061 carries SIP over TLS, encrypting call setup and credentials. Pair 5061 with SRTP to protect the media as well as the signaling.
- Does SIP over TLS prevent toll fraud?
- It protects signaling in transit but not weak accounts. Attackers still enumerate extensions and brute-force credentials, so strong passwords, IP restrictions, and rate limiting remain essential.