Which ports really have to be opened for a 3CX system? A clean answer is nowhere to be found online. Here it is: five network diagrams with every inbound and outbound rule – from on-premises and SBC through to VLAN segmentation.
Which ports actually have to be opened for a 3CX system? A clean answer is nowhere to be found online – the details are scattered across manuals and forums and do not cover special cases such as VLAN segmentation at all. So we compiled the port rules for 3CX V20 in full: five network diagrams with every inbound and outbound rule, including the rules between VLANs.
The 3CX PBX sits on your own network and is reachable from the internet. The classic case – and the only one in which inbound port openings are strictly required.
| Direction | Port(s) | Purpose | When / what to watch |
|---|---|---|---|
| inbound | 5060 UDP · 5060–5061 TCP | SIP signalling from the trunk | Always with a SIP trunk. Restrict to the provider’s IP ranges. |
| inbound | 9000–10999 UDP | RTP – the actual voice data | Always. 2 ports per simultaneous call. |
| inbound | 443 TCP (alt. 5001) | Web client, console, presence, provisioning, WebRTC | Always. Must remain reachable from ANY – home office, hotel, on the road. |
| inbound | 5090 TCP + UDP | 3CX tunnel for SBC, apps, router phones | As soon as an SBC or remote apps are used. TCP AND UDP – TCP alone gives one-way audio. |
| inbound | 80 TCP | Let’s Encrypt validation, redirect to HTTPS | For automatic certificate renewal. Not officially documented. |
| outbound | 443 TCP | 3CX cloud: activation, updates, RPS, mail, push, WebMeeting | Always – details in diagram 5. |
| outbound | 2197 + 5223 TCP | Apple APNs push | Only when iOS apps are used. |
| outbound | 48000–65535 UDP | Video conference media stream | Only when using 3CX Meet. |
| outbound | 3478 UDP · 53 · 123 | STUN, DNS, NTP | Always. DNS and NTP are technically essential but not documented by 3CX. |
The PBX lives in the 3CX cloud and an SBC sits on site. The big advantage: the site firewall needs no inbound openings at all.
| Direction | Port(s) | Purpose | When / what to watch |
|---|---|---|---|
| none / not needed | inbound: NONE | No port forwarding, no inbound rule | Always applies – the SBC only ever connects outwards. |
| outbound | 5090 TCP + UDP | 3CX tunnel: SIP and RTP bundled to the cloud PBX | Always. Open TCP AND UDP. |
| outbound | 443 TCP (alt. 5001) | HTTPS to the PBX: provisioning, auth, firmware | Always – for SBC, phones and apps. |
| outbound | 123 UDP · 53 UDP/TCP | NTP and DNS for SBC and phones | Always. Without correct time, TLS validation fails during provisioning. |
| outbound | 80 / 443 TCP | Phone vendor RPS | Only for the first provisioning of factory-new or reset phones. |
| local / LAN | 5060 UDP + RTP | SIP and media between phone and SBC | Uncritical on the same network. With VLAN separation see diagram 3. |
| local / LAN | 224.0.1.75 : 5060 UDP | Plug & Play (SIP multicast, NOT mDNS/5353) | Works only within the same layer-2 segment. |
| none / not needed | 5060/5061 · 9000–10999 · 3478 | Deliberately keep closed when using an SBC | SIP and RTP travel encapsulated in the tunnel – which reduces the attack surface considerably. |
SBC in VLAN 2, phones in VLAN 3, workstations in VLAN 1. In addition to the perimeter firewall, ports now have to be opened in the layer-3 switch or the internal firewall as well.
| Direction | Port(s) | Purpose | When / what to watch |
|---|---|---|---|
| between VLANs | 5060 UDP (ggf. TCP) | VLAN 3 → VLAN 2: SIP to the SBC as outbound proxy | Always. By default the SBC listens on 5060/UDP for local endpoints. |
| between VLANs | no documented range – in practice dyn. UDP | VLAN 3 → VLAN 2: RTP/media to the SBC | 3CX publishes NO RTP range for the SBC. 9000–10999 applies to the PBX media server, not the SBC. In practice, open the dynamic UDP range specifically towards the SBC IP. |
| between VLANs | 5060 + ephemere UDP | VLAN 2 → VLAN 3: return direction SIP/RTP | Covered by the forward rule on stateful firewalls; explicitly needed with static ACLs. |
| none / not needed | 224.0.1.75 : 5060 UDP | Plug & Play – not routable | Multicast does not cross VLAN boundaries. 3CX states PnP across VLANs is unsupported. An mDNS repeater does NOT help (it only reflects 224.0.0.251:5353). |
| outbound | 443 TCP | VLAN 3 → internet: provisioning and firmware | Mandatory. The SBC is not a provisioning server – the phones fetch their config directly from the cloud. |
| between VLANs | 67 / 68 UDP (DHCP-Relay) | VLAN 3 → DHCP: option 66 or 132/133 | The recommended substitute for PnP. Note: Option 66 overrides PnP – do not run both in parallel. |
| between VLANs | 80 TCP | VLAN 1 → VLAN 3: legacy CTI (phone control) | Only in the old CTI mode. Not needed with modern uaCSTA. |
| none / not needed | VLAN 1 → VLAN 2: none | Apps do not need to reach the SBC | The 3CX apps register directly with the cloud PBX. |
The 3CX PBX sits in the server VLAN, phones and workstations in their own VLANs. The return direction server → phones matters most here – and is easily forgotten.
| Direction | Port(s) | Purpose | When / what to watch |
|---|---|---|---|
| between VLANs | 5060 UDP + TCP · 5061 TLS | VLAN 3 → VLAN 2: SIP registration and signalling | Always. TLS only with SIP/TLS and SRTP. |
| between VLANs | 9000–10999 UDP | VLAN 3 ↔ VLAN 2: RTP to the media server | Always. 3CX has only ONE media server range – internal and external alike, not configurable. Calls between two phones in the same VLAN do not cross the boundary. |
| between VLANs | 443 TCP (alt. 5001) | VLAN 3 → VLAN 2: provisioning, firmware, phone book | Always. There is no separate provisioning port – it is the PBX web server port. |
| between VLANs | 5060 UDP/TCP ⚠ | VLAN 2 → VLAN 3: SIP NOTIFY (check-sync, BLF, voicemail LED) | Always – and the most common mistake. Without this rule calls still work, but reprovisioning, BLF keys and the voicemail indicator do not. |
| between VLANs | 443 TCP · 9000–10999 UDP | VLAN 1 → VLAN 2: web client / desktop app incl. WebRTC | Always when workstations sit in their own VLAN. |
| between VLANs | 22 · 443 · 5015 TCP | Management VLAN → VLAN 2: SSH, console, setup wizard | V20 runs on Debian 12 only – RDP/3389 is gone. 5015 only temporarily during setup. |
| between VLANs | 53 UDP/TCP ⚠ | All VLANs → DNS: split DNS | Mandatory for V20 on-premises. The FQDN must resolve to the internal server IP in EVERY VLAN, otherwise traffic hairpins through the firewall and you typically get one-way audio. |
| between VLANs | 80 TCP | VLAN 1 → VLAN 3: legacy CTI | Only in the old CTI mode. ‘Same subnet’ is a simplification – routing plus a port rule is enough. |
Applies to every self-hosted PBX. All destinations use 443/TCP – but three of them must not pass through TLS inspection.
| Direction | Port(s) | Purpose | When / what to watch |
|---|---|---|---|
| outbound | activate.3cx.com : 443 | Licence activation and verification | Always. ⚠ Allow without SSL inspection. |
| outbound | discoverv4.3cx.com : 443 | Discovery / FQDN resolution | Always. ⚠ Allow without SSL inspection. |
| outbound | pbxservicespush.3cx.com : 443 | Push service – wakes the smartphone apps | When apps are used. ⚠ Allow without SSL inspection. |
| outbound | downloads-global.3cx.com : 443 | Updates, service packs, phone firmware | Always. |
| outbound | rps.3cx.com : 443 | Remote provisioning of IP phones | Only with RPS provisioning. |
| outbound | mailproxy.3cx.com : 443 | E-mail delivery (voicemail, system messages) | Always when the 3CX mail proxy is used. |
| outbound | wmr.3cx.net : 443 | WebMeeting and transcription | Only for video conferencing. The transcription return channel comes from wmr-in.3cx.net (34.40.92.110). |
| outbound | stun2.3cx.com : 3478 UDP | STUN – NAT detection, Firewall Checker | When operating behind NAT. |
| outbound | Apple APNs : 443 · 2197 · 5223 | Push to iOS apps | Only with iPhone/iPad apps. |
| outbound | Google FCM : 443 | Push to Android apps | Only with Android apps. |
All 79 rules from the five scenarios in one piece – grouped by use case, with purpose, condition, endpoint and bindingness. For looking things up and ticking them off during firewall configuration.
| Port(s) | Protocol | Direction | Purpose & notes | Endpoint / target | Status |
|---|---|---|---|---|---|
| A · INBOUND to the 3CX PBX (self-hosted / on-premises / own cloud server) | |||||
| 5060 | UDP | inbound | SIP signalling: registration, call set-up and tear-down (default port, unencrypted).Whenever a SIP trunk or external phones talk to the PBX directly (without tunnel/SBC). Recommendation: restrict to the SIP provider’s IP ranges to avoid scans and attacks. | SIP provider / external phones | Required |
| 5060–5061 | TCP | inbound | SIP over TCP (5060) or SIP over TLS = encrypted signalling (5061).Only if the trunk or the endpoints use SIP over TCP or SIP-TLS instead of UDP. Not needed with a pure UDP trunk. | SIP provider / external phones | Conditional |
| 9000–10999 | UDP | inbound | RTP – the actual voice and video stream (the call audio). Each simultaneous call occupies 2 ports.Always for external voice traffic without the 3CX tunnel. The range can be reduced for few lines, but must hold at least 2× the number of simultaneous calls. | SIP provider / external phones | Required |
| 5090 | TCP AND UDP | inbound | 3CX tunnel protocol: encapsulates SIP + RTP in a single connection. Endpoint for 3CX SBCs, apps and 'router phones'.Whenever a 3CX SBC, remote apps (desktop/smartphone) or remote phones are used. IMPORTANT: open TCP AND UDP – TCP alone leads to one-way audio. | 3CX SBC / apps (any IP) | Required for SBC/apps |
| 443 (alternatively 5001) | TCP | inbound | HTTPS: web client, management console, presence, endpoint provisioning, WebRTC.Always for access from outside. 443 is the default from V20, 5001 the alternative/older HTTPS port. Must be reachable from 'ANY' (home office, hotel, on the road) – do not restrict to fixed IPs. | Any clients (internet) | Required |
| 443 | TCP | inbound | Video conferencing: external participants connect to the PBX through their browser.Only when using 3CX Meet / video conferencing. Identical to the HTTPS port above – no extra rule if 443 is already open. | Conference participants (internet) | Conditional |
| 443 | TCP | inbound | Return channel of the 3CX transcription service to the PBX.Only if call recording with transcription is used. Source can be restricted to wmr-in.3cx.net (34.40.92.110). | wmr-in.3cx.net (34.40.92.110) | Optional |
| 80 | TCP | inbound | HTTP: validation of the Let's Encrypt certificate (ACME HTTP-01) and redirect to HTTPS.Practical recommendation for automatic certificate renewal. Not explicitly documented by 3CX as a firewall requirement, but regularly needed in practice. | Let's Encrypt / internet | Recommended |
| 5000 | TCP | inbound | Alternative HTTP port of the PBX (older default).Only with a deviating port configuration. Per 3CX: never assign 443 to HTTP or 80 to HTTPS – firewalls will not work correctly otherwise. | Any clients | Special case only |
| 5062 (5061 in rare cases) | TCP | inbound | SIP signalling for Microsoft Teams Direct Routing.Only with Teams Direct Routing. Also required: a public DNS A record to a static IP and a certificate from a Microsoft-recognised CA. | Microsoft Teams / MS cloud | Special case only |
| 5015 | TCP | inbound | Web configuration wizard during the initial installation of the PBX.Only during initial set-up; close again afterwards. Documented only in community sources, not in the official firewall docs. | Admin workstation | Set-up only |
| B · OUTBOUND from the 3CX PBX (self-hosted – destination: 3CX cloud & provider) | |||||
| 443 | TCP | outbound | Licence activation and periodic licence verification.Always. CAUTION: allow without SSL/TLS inspection (uninspected) – otherwise activation fails. | activate.3cx.com | Required |
| 443 | TCP | outbound | 3CX discovery service (FQDN/instance resolution).Always. Likewise allow without SSL inspection. | discoverv4.3cx.com | Required |
| 443 | TCP | outbound | Download of updates, service packs and phone firmware.Always, so the PBX can update itself. | downloads-global.3cx.com | Required |
| 443 | TCP | outbound | RPS – Remote Provisioning Service: remote configuration of IP phones through the vendor cloud.Only if phones are provisioned via RPS outside the LAN. | rps.3cx.com | Conditional |
| 443 | TCP | outbound | E-mail delivery (voicemail notifications, system messages, conference invitations) via the 3CX mail proxy.Always when the 3CX mail server is used instead of your own SMTP server. | mailproxy.3cx.com | Required (default) |
| 443 | TCP | outbound | PBX push service – wakes the smartphone apps on incoming calls.Always when smartphone apps are used. Allow without SSL inspection. | pbxservicespush.3cx.com | Required for apps |
| 443 | TCP | outbound | WebMeeting/video conferencing service and transcription in the 3CX cloud.Only when using video conferencing or transcription. | wmr.3cx.net | Conditional |
| 443 | TCP | outbound | Push notifications to Android apps via Google Firebase (FCM).Only when Android apps are used. | Google FCM | Conditional |
| 443, 2197, 5223 | TCP | outbound | Push notifications to iOS apps via Apple APNs.Only when iPhone/iPad apps are used. Open all three ports. | Apple APNs | Conditional |
| 48000–65535 | UDP | outbound | Media stream (audio/video) of the video conference between PBX/participants and the 3CX cloud.Only when using 3CX Meet / video conferencing. | 3CX WebMeeting cloud | Conditional |
| 5060 (or 5061 TLS) | UDP / TCP | outbound | SIP signalling to the VoIP provider (return direction of the inbound trunk).Always with a SIP trunk. Usually covered by the inbound rule on stateful firewalls; explicitly needed with a restrictive outbound rule set. | SIP provider | Required |
| 9000–10999 | UDP | outbound | RTP voice data to the VoIP provider.Always for external voice traffic; open explicitly with a restrictive outbound rule set. | SIP provider | Required |
| 3478 | UDP | outbound | STUN – determines the public IP / NAT type; used among others by the 3CX Firewall Checker.When operating behind NAT and for the firewall check. Default STUN server: stun2.3cx.com. | stun2.3cx.com | Recommended |
| 53 | UDP / TCP | outbound | DNS – resolution of the PBX's own FQDN, the 3CX cloud services and the provider.Always. Technically essential, but not documented by 3CX as a separate firewall requirement. | DNS server | Required (technical) |
| 123 | UDP | outbound | NTP – time synchronisation. A wrong system time breaks TLS certificates and licence verification.Always. Technically essential, not documented by 3CX as a separate firewall requirement. | NTP server | Required (technical) |
| 25 / 587 / 465 | TCP | outbound | SMTP directly to your own mail server (instead of via mailproxy.3cx.com).Only if your own SMTP server is configured. The port depends on the mail server (25 = plain, 587 = STARTTLS, 465 = SMTPS). | Own SMTP server | Optional |
| 2528 | TCP | outbound | Old 3CX SMTP relay port for mail delivery.Legacy systems up to V18 only. From V20, mail goes via mailproxy.3cx.com on port 443 – then no longer needed. | 3CX SMTP relay | Legacy only |
| C · SITE WITH 3CX SBC / DESK PHONES (rules in the site firewall) | |||||
| NONE | — | inbound | At a site with an SBC, NO inbound port openings and NO port forwarding are needed.Always applies: the SBC connects exclusively outwards to the PBX. That is the main advantage of the SBC over directly registered phones. | — | Note |
| 5090 | TCP AND UDP | outbound | 3CX tunnel from the SBC to the PBX – carries SIP signalling AND RTP voice data bundled.Whenever an SBC is used. Open TCP AND UDP – TCP alone leads to one-way audio. | FQDN of the 3CX PBX | Required |
| 443 (or 5001) | TCP | outbound | HTTPS to the PBX: provisioning of the SBC and the phones, authentication, firmware updates.Always. Which port applies depends on the instance – 443 for 3CX-hosted, often 5001 for older self-hosted installations. Visible in the management console URL. | FQDN of the 3CX PBX | Required |
| 53 | UDP / TCP | outbound | DNS – resolution of the 3CX PBX FQDN.Always. | DNS server | Required |
| 123 | UDP | outbound | NTP – time synchronisation for SBC and phones.Recommended. Phones can alternatively obtain the time via a DHCP option. | NTP server | Recommended |
| 80 / 443 | TCP | outbound | The phone vendor’s RPS (Yealink, Fanvil, Snom …) at the very first provisioning.Only for first provisioning of factory-new or factory-reset phones. Not needed in normal operation. | Vendor's RPS server | First set-up only |
| 5060 | UDP (TCP if used) | LAN-internal only | SIP between phone and SBC on the local network. The phone uses the SBC LAN IP as its outbound proxy.Always with an SBC. With an SBC on Windows, the local Windows firewall must allow this port. | Phone → SBC (LAN) | LAN-internal |
| 224.0.1.75 : 5060 | UDP (multicast) | LAN-internal only | Plug & Play / autodiscovery: the phone sends a SIP SUBSCRIBE to multicast address 224.0.1.75, the SBC reports the find to the PBX. 3CX does NOT use mDNS/5353 for PnP.Only for Plug & Play. Works exclusively within the same layer-2 segment – not across VLAN/subnet boundaries (see sections F/G). The switch must flood unknown multicast or have IGMP snooping configured accordingly. | Phone → 224.0.1.75 (LAN) | LAN-internal |
| no fixed range | UDP | LAN-internal only | RTP/media between phone and SBC – the SBC relays the voice data into the tunnel.Always during calls. CAUTION: 3CX publishes NO port range for the SBC towards local phones (9000–10999 is the range of the PBX media server, not the SBC). Uncritical within one segment – relevant only with VLAN separation (section F). | Phone ↔ SBC (LAN) | LAN-internal |
| 80 | TCP | LAN-internal only | CTI / phone control: the 3CX client controls the desk phone (legacy CTI via HTTP command directly to the phone IP).Only in the old CTI mode. Modern uaCSTA (V18/V20) controls the phone through the existing SIP registration from the PBX – then no client→phone rule is needed. | Client → phone (LAN) | LAN-internal |
| D · 3CX-HOSTED INSTANCE (3CX-hosted / StartUP – rules in the customer firewall) | |||||
| NONE | — | inbound | With 3CX-hosted instances, NO inbound rules are needed in the customer firewall.Always applies – all connections are opened outwards from the customer network. Note: the 'inbound' column of the 3CX docs refers to the server; in the hosted model it corresponds to OUTBOUND rules at the customer. | — | Note |
| 5090 | TCP AND UDP | outbound | 3CX tunnel to the hosted PBX – for SBC, apps and router phones.Whenever an SBC or apps are in use. | FQDN of the hosted PBX | Required |
| 443 | TCP | outbound | HTTPS: web client, provisioning, WebRTC, video conferencing.Always. | FQDN of the hosted PBX | Required |
| 9000–10999 | UDP | outbound | RTP voice data between endpoints/web client and the hosted PBX.Always when phones or the web client talk to the PBX directly (without tunnel). | FQDN/IP of the hosted PBX | Required |
| 5060 (or 5061 TLS) | UDP / TCP | outbound | SIP signalling when phones register directly with the hosted PBX.Only if NO SBC/tunnel is used. With an SBC everything runs over 5090. | FQDN/IP of the hosted PBX | Conditional |
| 48000–65535 | UDP | outbound | Video conference media stream from the workstation to the 3CX WebMeeting cloud.Only when video conferencing is used from the customer network. | 3CX WebMeeting cloud | Conditional |
| E · NOT NEEDED when using the 3CX SBC / tunnel (deliberately keep closed) | |||||
| 5060 / 5061 | UDP / TCP | inbound | SIP – with an SBC it travels encapsulated in the tunnel (port 5090).Do not open if only the SBC/tunnel is used. Reduces the attack surface considerably. | — | Not needed |
| 9000–10999 | UDP | inbound | RTP – likewise travels in the tunnel when an SBC is used.Do not open if only the SBC/tunnel is used. | — | Not needed |
| 3478 | UDP | outbound | STUN – no NAT traversal detection needed at the SBC site, as only outbound connections are made.Not needed at the SBC site (though possibly at the PBX itself). | — | Not needed |
| F · VLAN SEGMENTATION with CLOUD PBX + SBC on site (rules in the layer-3 switch / internal firewall) | |||||
| 5060 | UDP (TCP if used) | inter-VLAN | SIP registration and signalling: the phone uses the SBC LAN IP as its outbound proxy.Always when phones and SBC sit in separate VLANs. By default the SBC listens on 5060/UDP for local SIP endpoints. | VLAN 3 (phones) → VLAN 2 (SBC) | Required |
| no documented range – in practice UDP 1024–65535 | UDP | inter-VLAN | RTP/media between phone and SBC. The SBC accepts the phone’s voice data and forwards it through the tunnel to the cloud PBX.Always during calls. CAUTION: 3CX publishes NO RTP port range for the SBC towards local phones – the well-known 9000–10999 applies to the PBX media server, not the on-site SBC process. In practice, open the dynamic UDP range specifically towards the SBC IP. | VLAN 3 (phones) → VLAN 2 (SBC) | Required |
| 5060 + ephemeral UDP ports | UDP | inter-VLAN | Return direction of SIP and RTP from the SBC to the phone.Covered by the forward rule on stateful firewalls. Open explicitly only with purely static ACLs (e.g. on a layer-3 switch without session tracking). | VLAN 2 (SBC) → VLAN 3 (phones) | Conditional |
| 224.0.1.75 : 5060 | UDP (multicast) | inter-VLAN | Plug & Play / autodiscovery of the phones by the SBC (SIP multicast, NOT mDNS/5353).DOES NOT WORK across VLAN boundaries. Multicast is not routable without multicast routing, and an mDNS repeater/reflector does not help (it only reflects 224.0.0.251:5353). 3CX explicitly states PnP across VLANs is unsupported. Solution: put the SBC in the phone VLAN OR use DHCP option 66 / RPS / a manual provisioning URL. | VLAN 3 → VLAN 2 (not routable) | Not possible |
| 443 (old: 5001) | TCP | inter-VLAN / outbound | Provisioning and firmware: the phones fetch their configuration DIRECTLY from the cloud PBX – the SBC is not a provisioning server and has no web GUI.Always. The phone VLAN strictly needs outbound internet access on 443/TCP to the PBX FQDN – otherwise no phone provisions. With 3CX hosting, HTTP+IP is not possible, only HTTPS+FQDN. | VLAN 3 (phones) → internet / PBX FQDN | Required |
| 53 | UDP / TCP | inter-VLAN | DNS – resolution of the PBX FQDN by the phones (mandatory with HTTPS provisioning; an IP is not enough).Always. Allow towards the internal resolver or the internet. | VLAN 3 → DNS resolver | Required |
| 123 | UDP | inter-VLAN / outbound | NTP – time synchronisation of the phones. 3CX provisions pool.ntp.org by default.Always. Without correct time, the TLS/certificate check fails during provisioning. | VLAN 3 → NTP server / internet | Required |
| 67 / 68 (DHCP relay) | UDP | inter-VLAN | DHCP relay ('ip helper-address') in the phone VLAN: address assignment and delivery of option 66 (provisioning URL) or options 132/133 (VLAN ID/priority).Always when the DHCP server is not in the phone VLAN. Option 66 is the recommended PnP substitute with VLAN separation. Note: option 66 overrides PnP – do not run both in parallel. | VLAN 3 → DHCP server | Required |
| 80 | TCP | inter-VLAN | Legacy CTI: the 3CX client on the workstation sends HTTP commands directly to the desk phone IP.Only in the old CTI mode. Works routed across VLANs (routing + port rule are enough), even though 3CX writes 'same network'. NOT needed with modern uaCSTA (V18/V20) – there the PBX controls the phone through the SIP registration. | VLAN 1 (clients) → VLAN 3 (phones) | Conditional |
| NONE | — | inter-VLAN | The 3CX desktop/web apps do NOT need to reach the SBC – they register directly with the cloud PBX.Always applies. The SBC is intended exclusively for IP desk phones. No clients → SBC rule needed. | VLAN 1 (clients) → VLAN 2 (SBC) | Not needed |
| 80 / 443 | TCP | inter-VLAN | Web interface of the phones for administrative access.Optional, only if admins should reach the phone web interfaces from the data/management VLAN. | Management VLAN → VLAN 3 (phones) | Optional |
| 443 / 80 | TCP | outbound | The phone vendor’s RPS (Yealink/Fanvil/Snom) at the first boot of factory-new devices.Only with RPS provisioning. Often the most practical route with VLAN separation, since PnP is unavailable. The vendors’ destination addresses are not documented by 3CX. | VLAN 3 (phones) → internet | First set-up only |
| G · VLAN SEGMENTATION with INTERNALLY HOSTED 3CX PBX (rules in the layer-3 switch / internal firewall) | |||||
| 5060 | UDP + TCP | inter-VLAN | SIP registration and signalling of the desk phones to the PBX.Always. UDP is the default transport; TCP additionally if phones are configured for SIP/TCP. | VLAN 3 (phones) → VLAN 2 (3CX) | Required |
| 5061 | TCP | inter-VLAN | SIP over TLS – encrypted signalling.Only if SIP/TLS and SRTP are in use. | VLAN 3 (phones) → VLAN 2 (3CX) | Conditional |
| 9000–10999 | UDP | inter-VLAN | RTP/audio between phone and the PBX media server. 2 ports per call.Always. IMPORTANT: 3CX has only ONE media server range – it applies internally and externally and is not officially configurable. Calls between two phones in the same VLAN run endpoint-to-endpoint and do not cross the boundary. | VLAN 3 (phones) ↔ VLAN 2 (3CX) | Required |
| 443 (old: 5001) | TCP | inter-VLAN | HTTPS: phone provisioning, firmware, phone book. There is NO separate provisioning port – it is the PBX web server port.Always. Which port applies was set during installation (443 recommended, 5001 as the alternative). | VLAN 3 (phones) → VLAN 2 (3CX) | Required |
| 80 (old: 5000) | TCP | inter-VLAN | HTTP provisioning via the PBX IP address.Only if an HTTP provisioning URL is used. Permitted by 3CX exclusively for local phones in RFC1918 networks – remote phones must use HTTPS+FQDN. | VLAN 3 (phones) → VLAN 2 (3CX) | Conditional |
| 5060 (the phone's SIP port) | UDP / TCP | inter-VLAN | Return direction: the PBX sends SIP NOTIFY to the phones – 'check-sync' (restart/reprovisioning), 'ua-profile', BLF status updates and MWI (voicemail lamp).Always. Often forgotten – the symptom is that reprovisioning, BLF keys and the voicemail indicator stop working. The server does not push configuration – the phone fetches it itself after the NOTIFY. | VLAN 2 (3CX) → VLAN 3 (phones) | Required |
| the phone's RTP range (vendor-specific) | UDP | inter-VLAN | Return direction of the RTP stream: the PBX sends from 9000–10999 to the phone’s RTP port (e.g. Yealink ~11780–11800, Snom from 49152).Covered by the forward rule on stateful firewalls. With purely static ACLs, look up the RTP range of the deployed phones in the manual and open it. | VLAN 2 (3CX) → VLAN 3 (phones) | Conditional |
| 443 (old: 5001) | TCP | inter-VLAN | Web client and desktop app: HTTPS + WebSocket, sign-in, presence, client updates.Always when workstations sit in their own VLAN. | VLAN 1 (clients) → VLAN 2 (3CX) | Required |
| 9000–10999 | UDP | inter-VLAN | WebRTC media of the softphone in the web client / desktop app.Always when clients phone in softphone mode. (In practice the WebRTC share sits in the sub-range 10500–10999 – not officially documented, do not use as a filter criterion.) | VLAN 1 (clients) → VLAN 2 (3CX) | Required |
| 5090 | TCP + UDP | inter-VLAN | 3CX tunnel – normally not needed internally, as the web client uses WebRTC over 443.Optional. 3CX does not state whether 5090 is needed internally. The rule is harmless and saves troubleshooting if a client falls back to tunnel mode. | VLAN 1 (clients) → VLAN 2 (3CX) | Optional |
| 80 | TCP | inter-VLAN | Legacy CTI: the 3CX client sends HTTP commands directly to the desk phone IP.Only in the old CTI mode. Works routed across VLANs. Not needed with modern uaCSTA – there control runs through the SIP registration from the PBX. | VLAN 1 (clients) → VLAN 3 (phones) | Conditional |
| 224.0.1.75 : 5060 | UDP (multicast) | inter-VLAN | Plug & Play / autodiscovery of the phones by the PBX (SIP multicast, NOT mDNS/5353).DOES NOT WORK across VLAN boundaries – 3CX names 'phone and PBX in the same local subnet' as a PnP prerequisite and explicitly advises against PnP across VLANs. Substitutes: DHCP option 66, a manual provisioning URL, RPS, or an SBC in the phone VLAN. | VLAN 3 → VLAN 2 (not routable) | Not possible |
| 53 | UDP / TCP | inter-VLAN | DNS – strictly with SPLIT DNS: the PBX FQDN must resolve to the internal server IP in EVERY VLAN.Always. If a VLAN resolves the FQDN to the public IP, the PBX writes the public IP into the SDP and voice traffic hairpins through the firewall – typical result: one-way audio. 3CX V20 strictly requires split DNS on-premises. | All VLANs → DNS resolver | Required |
| 123 | UDP | inter-VLAN | NTP – time synchronisation of phones and clients.Always. Wrong time leads to certificate errors and wrong call times. | VLAN 1 + VLAN 3 → NTP server | Required |
| 67 / 68 (DHCP relay) | UDP | inter-VLAN | DHCP relay ('ip helper-address') in the phone VLAN – address assignment and option 66 (provisioning URL) or 132/133 (VLAN ID/priority).Always when the DHCP server is not in the phone VLAN. Option 66 is the recommended PnP substitute with VLAN separation. | VLAN 3 → DHCP server | Required |
| 443 (old: 5001) | TCP | inter-VLAN | Access to the PBX management console.Always when administration happens from a management VLAN. | Management VLAN → VLAN 2 (3CX) | Required |
| 22 | TCP | inter-VLAN | SSH – administration of the Debian operating system (V20 runs exclusively on Debian 12; RDP/3389 is gone, Windows is no longer supported).Optional, for OS administration. Not documented in any 3CX port list. Restrict access to the management VLAN where possible. | Management VLAN → VLAN 2 (3CX) | Optional |
| 5015 | TCP | inter-VLAN | Web configuration wizard during initial installation.Only temporarily during first set-up, block again afterwards. | Management VLAN → VLAN 2 (3CX) | Set-up only |
| 80 / 443 | TCP | inter-VLAN | Web interface of the phones for administrative access. The PBX itself does NOT access it – the link opens in the admin’s browser.Optional, only for administrative access from the management/data VLAN. | Management VLAN → VLAN 3 (phones) | Optional |
| 443 | TCP | outbound | Outbound connections of the PBX to the 3CX cloud services (see section B) – from the server VLAN to the internet.Always. In segmented networks, remember that the server VLAN also needs a route to the internet. | VLAN 2 (3CX) → internet | Required |
The „SIP helper“ in routers and firewalls manipulates SIP packets and is the most common cause of one-way audio and dropped calls. Switch it off in every scenario.
Only TCP opened? The tunnel comes up, but audio flows in one direction only. Always open both protocols.
activate.3cx.com, discoverv4.3cx.com and pbxservicespush.3cx.com must pass uninspected – breaking TLS makes activation and push fail.
Staff connect from home offices, hotels and mobile networks. Only the SIP ports (5060/5061) can sensibly be restricted to the provider’s IPs.
Each simultaneous call occupies 2 UDP ports. The default range 9000–10999 covers up to 1,000 calls.
With a 3CX SBC on site, all inbound rules disappear: SIP and RTP travel encapsulated through the outbound tunnel on port 5090.
The 3CX docs list ports from the server’s point of view. With a 3CX-hosted PBX these become outbound rules in your firewall – nothing inbound is needed.
After configuration, run the 3CX Firewall Checker: it tests the PBX side and reports missing rules and active SIP ALG.
3CX uses SIP multicast (224.0.1.75:5060) for phone discovery – not mDNS. Multicast is not routable: with VLAN separation, provision via DHCP option 66 or RPS instead.
Understandable. We configure firewall and PBX in one pass – including a SIP-ALG check, a Firewall Checker run and clean documentation of the rules. As a WatchGuard and 3CX partner we know both sides. Talk to us.
For a self-hosted PBX, inbound: 5060/UDP (SIP), 5061/TCP (SIP-TLS), 9000–10999/UDP (RTP voice data), 5090/TCP+UDP (3CX tunnel for apps and SBC) and 443/TCP (HTTPS, web client, provisioning). Outbound rules to the 3CX cloud services come on top. The complete list by scenario is above in the technical section.
Outbound only: 5090/TCP+UDP (tunnel to the PBX), 443/TCP (provisioning) plus DNS and NTP. No inbound rules or port forwarding are needed at the SBC site – the SBC opens all connections outwards itself.
In the customer firewall, outbound rules only: 5090/TCP+UDP, 443/TCP, 9000–10999/UDP and – without an SBC – 5060/UDP to the PBX FQDN. Nothing needs to be opened inbound.
The two most common causes: SIP ALG is still active in the router or firewall, or port 5090 was opened for TCP only instead of TCP and UDP. Then run the 3CX Firewall Checker.
No. Phone discovery uses SIP multicast on 224.0.1.75:5060, and multicast is not routable without multicast routing. In segmented networks, provision via DHCP option 66 or the phone vendor’s RPS instead – or put the SBC in the phone VLAN.
No. No firewall port changes are documented between V18 and V20; the RTP range remains 9000–10999/UDP. The only novelty is that 443 has replaced 5001 as the default HTTPS port.
As a 3CX and WatchGuard partner we configure PBX and firewall in one pass – cleanly documented and verified with the Firewall Checker.