Common SIP Ports and What They Do

SIP and the protocols around it use a small set of well-known ports plus a range of dynamic ones. SIP signalling defaults to port 5060 over UDP and TCP, and 5061 over TLS. The audio travels over RTP on UDP ports negotiated per call from a configurable range, with RTCP on the neighbouring odd port. STUN, used for NAT discovery, listens on UDP 3478. These defaults are only defaults. Many PBXs and providers change the SIP port, and every system has its own RTP range, so the first step in any port question is to check the server's configuration.

Which ports does SIP signalling use?

RFC 3261 assigns the default port 5060 for SIP over UDP and TCP, and 5061 for SIP over TLS. The IANA port registry records both. A client that is given a server hostname with no port and finds no DNS SRV records falls back to these values.

Port	Transport	Use
5060	UDP	SIP signalling, the traditional default
5060	TCP	SIP signalling over a connection
5061	TCP	SIP over TLS (encrypted signalling)

Administrators often change these. A PBX exposed to the internet on 5060 receives a constant stream of scanning and brute-force attempts, so moving to a random high port cuts the noise. Some systems run two SIP stacks on one host. An Asterisk installation that still has the legacy chan_sip driver alongside PJSIP must bind each one to its own port. Which driver keeps 5060 depends on the distribution and its version, and the other moves to a port such as 5160 or 5061. Issabel, for example, commonly keeps chan_sip on 5060. Check the PBX's SIP settings rather than assuming.

The port can also be discovered through DNS. RFC 3263 describes the lookup of SRV records such as _sip._udp.example.com, _sip._tcp.example.com and _sips._tcp.example.com. Each SRV record names a host and port. A provider can therefore run SIP on any port and let compliant clients find it with only the domain name. SIPdia, like many clients, performs this SRV lookup when the Server field has no explicit port.

Which ports does RTP audio use?

RTP has no single well-known port. Each call negotiates its media port in the SDP body of the INVITE and 200 OK. Each endpoint picks a port from its own configured range and tells the other side. RFC 3550 recommends an even port for RTP and the next odd port for RTCP, so a call using 10000 for audio would use 10001 for RTCP.

Common ranges:

System	Default RTP range
Asterisk, FreePBX, Issabel	UDP 10000 to 20000
Many hosted providers	A provider-specific range, often documented in their setup guide
Softphones	A client-specific range, sometimes configurable

The server range matters when you host the PBX behind a firewall: inbound RTP from remote phones must reach it. The client range rarely needs attention because the client sends first and the router creates a mapping for the return traffic. When one-way audio appears, the cause is more often NAT address rewriting than a blocked port. See Understanding RTP and audio streams.

Which ports do STUN, TURN and ICE use?

STUN, defined in RFC 8489, lets a client discover its public IP address and port. STUN servers listen on UDP 3478 by default, and on TCP 3478 as well. STUN over TLS uses 5349. TURN servers, defined in RFC 8656, accept client requests on the same 3478 and 5349 ports, but the relayed media itself flows through ports the TURN server allocates from its own range. ICE itself has no port; it uses STUN messages on the RTP ports it is testing. Public STUN servers exist, and a softphone only needs outbound UDP to 3478 to use one.

What other ports appear in a VoIP setup?

• DNS, UDP and TCP 53. Needed for SRV and A record lookups.
• NTP, UDP 123. Accurate time matters for TLS certificate validation.
• HTTP and HTTPS, 80 and 443. Phone provisioning, PBX web interfaces and certificate issuance.
• Alternative SIP ports. Some providers use 5080, 5160 or a high random port. Some offer SIP over TLS on 443 to pass through strict firewalls.
• WebSocket SIP, usually 443 or 8089. Browser-based clients use SIP over WebSocket. Conventional softphones do not.

How do you find out which ports your server uses?

1. Read the provider's setup documentation. It normally lists the server, port, transport and RTP range.
2. On a PBX you control, check the SIP settings. In Asterisk the PJSIP transport sections and the rtp.conf file define them. FreePBX and Issabel show them under the SIP Settings and Asterisk SIP Settings pages.
3. Try a DNS SRV lookup for the domain. On macOS or Linux, dig SRV _sip._udp.example.com shows any records.
4. Capture the first REGISTER from a working device and look at the destination port.

How do you open ports safely?

Opening inbound ports is only needed when the server sits behind your firewall. For a softphone connecting outward to a hosted service, no inbound ports normally need opening, although a strict outbound firewall must still allow the SIP and RTP traffic.

For a self-hosted PBX reachable from the internet:

• Prefer not to expose SIP at all. Put remote users on a VPN, or restrict the SIP port to known source IP addresses.
• If exposure is unavoidable, use TLS on 5061 so credentials and signalling are encrypted, and disable UDP and TCP 5060 from the internet.
• Forward only the RTP range the PBX actually uses, and keep it as narrow as the expected number of concurrent calls allows.
• Run fail2ban or an equivalent to block addresses after repeated authentication failures.
• Enforce strong extension passwords and disable guest or anonymous calling.

For a softphone behind a home router, the issues are different. UDP mappings time out quickly, often after 30 to 120 seconds of silence. A short registration interval or keepalive packets keep the mapping alive so the server can reach the client. Many routers also have a SIP ALG feature that rewrites SIP messages and frequently breaks them. Disabling SIP ALG is a common fix for registration and audio problems; see What is SIP ALG and should you disable it?.

What if a port is blocked on your network?

Some corporate, hotel and mobile networks block outbound 5060 and 5061, or all UDP except DNS. Symptoms are a softphone that cannot reach the server at all. Options include asking the provider for an alternative port such as 443 for TLS, using a VPN, or connecting from a different network. Note that TCP 443 being open does not mean SIP will work on it unless the server listens there.

Next steps

The SIP port reference tool summarises these numbers in one place. To understand how the transport choice interacts with ports and NAT, read SIP over UDP, TCP and TLS. For what happens on the media ports, see Understanding RTP and audio streams.