This document details all network ports, protocols, and access scopes required by AiPBX for VoIP signaling, RTP media, WebRTC, administration, and provisioning.
| Port Range | Protocol | Service / Purpose | Default Scope | Reverse Proxy Bypass | Notes |
|---|---|---|---|---|---|
| 5060 | UDP / TCP | SIP Signaling | Public / LAN | YES | Desk phones, external trunks, softphones. |
| 5061 | TCP | SIP-TLS Signaling | Public / LAN | YES | Encrypted SIP signaling over TLS. |
| 10000–20000 | UDP | RTP / SRTP Media Streams | Public / LAN | YES | 2-way audio & video RTP packets. Must route directly. |
| 80 | TCP | HTTP Web & Provisioning | Public / LAN | NO | Web portal, phone auto-provisioning, ACME HTTP-01. |
| 443 | TCP | HTTPS Web Portal & API | Public / LAN | NO | Secure web interface, REST API, WebRTC WSS upgrade. |
| 8089 | TCP | Asterisk WebRTC WSS | Public / LAN | NO | WebRTC WebSocket signaling for browser calling. |
| 8088 | TCP | Asterisk HTTP / WS | Internal / Proxy | NO | Plain HTTP Asterisk endpoint for reverse proxying. |
| 3478 | UDP / TCP | STUN / TURN (coturn) | Public | YES | NAT traversal candidate discovery & media relay. |
| 5349 | TCP | TURNS TLS (coturn) | Public | YES | Encrypted TLS TURN relay for strict networks. |
| 69 | UDP | TFTP Phone Provisioning | LAN only | YES | Legacy desk phone configuration and firmware. |
| 9061 | UDP | HEP / Homer SIP Capture | Internal / LAN | YES | Encapsulated SIP packet capture for monitoring. |
| 5038 | TCP | AMI (Asterisk Manager) | Localhost (127.0.0.1) | YES | Internal PBX daemon management. Never expose. |
| 3306 | TCP | MariaDB Database | Localhost (127.0.0.1) | YES | Internal PBX relational database. Never expose. |
If you provide remote softphone access, remote mobile app calling, or SIP trunks over the public internet:
80/tcp, 443/tcp, 5060/udp,tcp, 5061/tcp, 10000:20000/udp, 3478/udp,tcp, 5349/tcp, 8089/tcp.80/tcp and 443/tcp go through the reverse proxy. All SIP and RTP ports (5060, 5061, 10000-20000/udp) MUST route directly to the server host.192.168.10.0/24).127.0.0.1)127.0.0.1.127.0.0.1.Router and firewall SIP ALG implementations frequently corrupt SIP packet headers, SDP payloads, and Via branches.
IMPORTANT: Disable SIP ALG, SIP Inspection, or SIP Fixup on all edge routers and firewalls.
Ensure your edge firewall or NAT gateway forwards the entire UDP port range 10000:20000 to the AiPBX host. Asymmetrical or missing UDP forwarding causes “one-way audio” or dropped calls after 30 seconds.
On the PBX portal at Network → Network Settings:
192.168.1.0/24, 10.0.0.0/8). This ensures Asterisk rewrites SDP addresses correctly for public versus internal callers.# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Management & Web
sudo ufw allow 22/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP / ACME'
sudo ufw allow 443/tcp comment 'HTTPS Portal'
# SIP Signaling
sudo ufw allow 5060/udp comment 'SIP UDP'
sudo ufw allow 5060/tcp comment 'SIP TCP'
sudo ufw allow 5061/tcp comment 'SIP-TLS'
# RTP Audio / Video Media Range
sudo ufw allow 10000:20000/udp comment 'RTP Audio Media'
# WebRTC STUN / TURNS
sudo ufw allow 3478/udp comment 'STUN / TURN UDP'
sudo ufw allow 3478/tcp comment 'STUN / TURN TCP'
sudo ufw allow 5349/tcp comment 'TURNS TLS'
sudo ufw allow 8089/tcp comment 'Asterisk WebRTC WSS'
# Enable firewall
sudo ufw enable
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-port=5060/udp
sudo firewall-cmd --permanent --add-port=5060/tcp
sudo firewall-cmd --permanent --add-port=5061/tcp
sudo firewall-cmd --permanent --add-port=10000-20000/udp
sudo firewall-cmd --permanent --add-port=3478/udp
sudo firewall-cmd --permanent --add-port=3478/tcp
sudo firewall-cmd --permanent --add-port=5349/tcp
sudo firewall-cmd --permanent --add-port=8089/tcp
sudo firewall-cmd --reload
| Type | Protocol | Port Range | Source | Description | |:—|:—|:—|:—|:—| | SSH | TCP | 22 | Admin IP / Bastion | Management | | HTTP | TCP | 80 | 0.0.0.0/0 | Portal & Auto-Provisioning | | HTTPS | TCP | 443 | 0.0.0.0/0 | Encrypted Web Portal | | Custom UDP | UDP | 5060 | 0.0.0.0/0 or Trunk IP | SIP Signaling | | Custom TCP | TCP | 5060–5061 | 0.0.0.0/0 or Trunk IP | SIP / SIP-TLS | | Custom UDP | UDP | 10000–20000 | 0.0.0.0/0 | RTP Two-Way Voice Streams | | Custom UDP/TCP | UDP/TCP | 3478 | 0.0.0.0/0 | STUN / TURN NAT Relay | | Custom TCP | TCP | 5349 | 0.0.0.0/0 | TURNS TLS Relay | | Custom TCP | TCP | 8089 | 0.0.0.0/0 | WebRTC WebSocket Signaling |