Page tree
Skip to end of metadata
Go to start of metadata

The table below outlines all the ports used on your PBX that you need to open on your hardware firewall if you want outside users to have access to things. These are default port assignments for new installs, but most can be changed by the user post install. Legacy versions may have used different default port numbers (notably http provisioning) and the original port numbers remain unaffected when the system is upgraded.

 

PBX Admin Access

PORTTCP/UCPPURPOSECHANGING PORTSECURITYNOTES
22TCPSSH ConsoleThis can only be changed inside from inside Linux CLI and not recommended to be changed.Not recommended to open this up to untrusted networks.Port used to allow SSH to the PBX from the outside world.

80 FreePBX

2001 PBXact

TCPPBX GUI HTTP (Non HTTPS)Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Not recommended to open this up to untrusted networks.Used to access the PBX Admin GUI

443

TCPPBX GUI HTTPSCan change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Not recommended to open this up to untrusted networks.Used to access the PBX Admin GUI with SSL encryption
1194TCP/UDPOpenVPN serverChange not supportedCan open to untrusted hostsUsed to connect OpenVPN clients to PBX VPN Server.

 

PBX SIP and IAX Communication

PORTTCP/UCPPURPOSECHANGING PORTSECURITYNOTES
5060UDPchan_PJSIP SignalingCan change this port inside the PBX Admin GUI SIP Settings module.Not recommended to open this up to untrusted networks.Standard Port used for chan_PJSIP Signalling.
5061 

chan_PJSIP
Secure Signaling

Can change this port inside the PBX Admin GUI SIP Settings module.Not recommended to open this up to untrusted networks.Secure Port used for chan_PJSIP Signalling.
5160UDPchan_SIP SignalingCan change this port inside the PBX Admin GUI SIP Settings module.Not recommended to open this up to untrusted networks.Standard Port used for chan_SIP Signalling.
5161 chan_SIP
Secure Signaling
Can change this port inside the PBX Admin GUI SIP Settings module.Not recommended to open this up to untrusted networks.Secure Port used for chan_SIP Signalling.
10000-20000UDPRTP for SIPCan change this port inside the PBX Admin GUI SIP Settings module.Safe to open to the outside world and is required by most SIP Carriers as your RTP traffic can come from anywhere.Used for the actual voice portion of a SIP Call.
4569UDPIAXCan change this port inside the PBX Admin GUI IAX Settings module.Not recommended to open this up to untrusted networks.Used for IAX protocol and trunking
4000-4999UDPFAX UDPTLNot configurable in the GUI, on by editing custom conf file.
Used for T38 fax media

PBX User Control Panel (UCP)

PORTTCP/UCPPURPOSECHANGING PORTSECURITYNOTES

81

TCPPBX User Control Panel (UCP) HTTP (Non HTTPS)Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS version of PBX User Control Panel instead for remote users.Port used to access the GUI portion of UCP

4443

TCPPBX User Control Panel (UCP) HTTPSCan change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Safe to open this up to untrusted networks as the traffic is encrypted and requires username and password authentication.Port used to access the GUI portion of UCP with SSL encryption
8088TCPWebRTC Unencrypted Softphone ClientCan change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTP Bind PortNot recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS versionUsed for the WebRTC portion of UCP
8089TCPWebRTC Encrypted Softphone ClientCan change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTPS Bind PortSafe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication.Used for the WebRTC portion of UCP
8001TCPNode ServerCan change this port inside the PBX Admin GUI > Advanced Settings > UCP NodeJS Server > NodeJS Bind PortNot recommended to open this up to untrusted networks as the traffic is not encrypted. Used by UCP with HTTP for Conf Rooms and Chatting and other products in UCP
8003TCPNode Server (secure)Can change this port inside the PBX Admin GUI > Advanced Settings > UCP NodeJS Server > NodeJS HTTPS Bind PortSafe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication.Used by UCP with HTTPS for Conf Rooms and Chatting and other products in UCP

PBX Phone Provisioning and Phone Apps

PORTTCP/UCPPURPOSECHANGING PORTSECURITYNOTES

84

TCPHTTP Provisioning for Phones (Non HTTPS)Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS Phone Provisioning option of instead for remote users.Make sure if opening up outside access to enable username and password authentication for HTTP provisioning from the PBX Admin GUI System Admin > Provisioning Protocol. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning. In the past, http provisioning defaulted to port 83. When upgrading older systems, the port assignments to not change from their original settings.

1443

TCPHTTPS Provisioning for PhonesCan change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Safe to open this up to untrusted networks as the traffic is encrypted as long as your enable username and password authentication as outlined in the Notes section.Make sure if opening up outside access to enable username and password authentication for HTTP provisioning from the PBX Admin GUI System Admin > Provisioning Protocol. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning.
21TCPFTP Provisioning for PhonesThis can only be changed inside from inside Linux CLI and not recommended to be changed.Not recommended to open this up to untrusted networks as it has no ability encrypt traffic and is not NAT Friendly. Recommend using HTTPS provisioning for remote phones instead.Used if your are having phones inside EPM use TFTP for provisioning. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning.
69UDPTFTP Provisioning for PhonesThis can only be changed inside from inside Linux CLI and not recommended to be changed.Not recommended to open this up to untrusted networks as it has no ability encrypt traffic and is not NAT Friendly.Used if your are having phones inside EPM use TFTP for provisioning. Inside EPM you define per template if the phones use TFTP, FTP, HTTP or HTTPS provisioning.

82

TCPPhone Apps HTTP (Non HTTPS)Can change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using Phone Apps HTTPS option of instead for remote users.Port used for phone apps to communicate with the PBX as HTTP not HTTPS traffic. Inside EPM you pick if the phone apps use HTTP or HTTPS.

3443

TCPPhone Apps HTTPSCan change this port inside the PBX Admin GUI > System Admin Module > Port Management section.Safe to open this up to untrusted networks as the traffic is encrypted.Port used for phone apps to communicate with the PBX using SSL encryption. Inside EPM you pick if the phone apps use HTTP or HTTPS.

Zulu 3

 

PORTTCP/UCPPURPOSECHANGING PORTSECURITYNOTES

8002

TCPZulu 3 Client Communication with PBXCan change this port inside the PBX Admin GUI > Advanced Settings > Zulu Section > Zulu Bind AddressSafe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication.Zulu 3 only requires this port to be opened. NOTE: You may require the "RTP for SIP" port range to be open as well, for call audio.

Zulu 2


PORTTCP/UCPPURPOSECHANGING PORTSECURITYNOTES

8002

TCPZulu 2 Client Communication with PBXCan change this port inside the PBX Admin GUI > Advanced Settings > Zulu Section > Zulu Bind AddressSafe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication.Zulu 2.0 requires this and the ports below to be opened. NOTE: You may require the "RTP for SIP" port range to be open as well, for call audio.
8088TCPZulu 2.0 Unencrypted Softphone ClientCan change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTP Bind PortIf using Zulu 3.0 this port should not be open. Not recommended to open this up to untrusted networks as the traffic is not encrypted. Recommend using HTTPS versionUsed for the softphone portion of Zulu
8089TCPZulu 2.0 Encrypted Softphone ClientCan change this port inside the PBX Admin GUI > Advanced Settings > Asterisk Builtin mini-HTTP section > HTTPS Bind Port If using Zulu 3.0 this port should not be open. Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication.Used for the softphone portion of Zulu
5000TCPZulu 2.0 ChatAt this time can not change the portIf using Zulu 3.0 this port should not be open. Safe to open this up to untrusted networks as the traffic is encrypted with SSL and requires username and password authentication.Used for chat portion of Zulu

 

RMS Monitoring

PORTSTCP/UCPPURPOSECHANGING PORTSECURITYNOTES

443
5071
4505 4506

TCP
Outbound 
Checks
Metrics
RPC 
N/ARMS only uses these ports for outbound connections.
Thus, no INBOUND firewall rule changes are necessary.

If the firewall is configured to block outbound ports/connections, then these ports need to be added to the allowed outbound port list. 
  • No labels