What uses port 5060
SIP signaling sets up and tears down voice and video calls between IP phones, PBXs such as Asterisk and FreePBX, and VoIP providers. The audio itself flows over RTP on a range of UDP ports (often 10000–20000). SIP over TLS uses 5061. Exposed SIP servers get a constant stream of attempts to register and make expensive international calls.
Should port 5060 be open to the internet?
Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.
- One-way audio or calls dropping after 30 seconds usually means the RTP ports or NAT settings are wrong, not SIP itself. Disable SIP ALG on the router.
Check what is listening on port 5060
sudo ss -ltnp 'sport = :5060'
sudo ss -lunp 'sport = :5060'sudo lsof -nP -iTCP:5060 -sTCP:LISTEN
sudo lsof -nP -iUDP:5060Get-NetTCPConnection -LocalPort 5060 -State Listen
Get-NetUDPEndpoint -LocalPort 5060
netstat -ano | findstr :5060No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 5060
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:5060 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 5060 -State Listen).OwningProcessAllow port 5060 from trusted networks only
The examples allow 5060 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 5060 proto udp
sudo ufw allow from 10.0.0.0/8 to any port 5060 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5060 proto udpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5060" protocol="udp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5060" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "SIP 5060/UDP" -Direction Inbound -Protocol UDP -LocalPort 5060 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "SIP 5060/TCP" -Direction Inbound -Protocol TCP -LocalPort 5060 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 5060 from another machine
nc -zv example.com 5060Test-NetConnection example.com -Port 5060Related ports
- Port 3478 (STUN / TURN): used by STUN and TURN servers for WebRTC and VoIP NAT traversal.
More messaging and queues ports
1883 (MQTT) , 4222 (NATS) , 4369 (Erlang Port Mapper (epmd)) , 5222 (XMPP client) , 5672 (AMQP (RabbitMQ)) , 8883 (MQTT over TLS) , 9092 (Apache Kafka) , 15672 (RabbitMQ management) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 5060 used for?
Port 5060 is used by SIP for setting up VoIP calls. SIP signaling sets up and tears down voice and video calls between IP phones, PBXs such as Asterisk and FreePBX, and VoIP providers. The audio itself flows over RTP on a range of UDP ports (often 10000–20000). SIP over TLS uses 5061. Exposed SIP servers get a constant stream of attempts to register and make expensive international calls.
Is it safe to open port 5060?
Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 5060 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :5060'" on Linux or "sudo lsof -nP -i :5060" on macOS. From another machine, run "nc -zv host 5060" or, on Windows, "Test-NetConnection host -Port 5060". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.