Network requirements
This page is generated by scripts/gen-network-requirements.sh from mpbx ports --markdown. Do not
edit it by hand; change the table in pbx/bin/mpbx/src/ports_cli.rs and run the script again.
Print the same table on an installed host with mpbx ports (text) or mpbx ports --markdown.
mpbx ports --config /etc/mpbx/mpbx.toml (or with MPBX_CONFIG set) first lists the listeners
your configuration really opens, from [http], [tls], [sip], [metrics] and [ice], then the
table. The command opens no socket and changes nothing. To check that the listeners are up on the host,
run mpbx doctor.
Rules that apply to every install
- Publish only the inbound rows you need. Databases, the cache, ClickHouse and the metrics port stay on the private network.
- Phones, browsers and trunks need UDP, TCP or TLS to the SIP ports they use. A firewall that drops the SIP ports makes phones unable to register.
- Media uses one UDP range in both directions. Keep the range open to the phones and trunks that send media, and NAT-map it when the PBX sits behind a router.
- Public HTTPS is required for the messaging channels (WhatsApp, Messenger, Telegram), the live chat widget and the browser softphone. Meta, Telegram and the widget must reach the address on port 443 with a certificate from a public certificate authority.
- Air-gapped installs keep only the inbound rows of their own users and the internal rows. Outbound rows that need the internet do not work there; see the air-gapped page.
Ports by direction
| Direction | Protocol | Port | Feature | Who connects | Set by |
|---|---|---|---|---|---|
| inbound | https | 443 (the address in [http] listen) | Web client, REST API, sign-in, provisioning URLs | Browsers, softphones, desk phones (provisioning), admins | [http] listen, [setup] fqdn |
| inbound | tcp | 80 | Plain HTTP redirect and ACME HTTP-01 challenge | Public internet (certificate authority) | automatic certificates ([tls] ACME settings) |
| inbound | udp | 5060 (example; set by listen_udp) | SIP signalling over UDP | Desk phones, softphones on the LAN, SIP trunks | [sip] listen_udp |
| inbound | tcp | 5060 (example; set by listen_tcp) | SIP signalling over TCP | Desk phones, SIP trunks | [sip] listen_tcp |
| inbound | tls | 5061 (set by listen_tls) | SIP over TLS (sips:) | Desk phones, softphones, SIP trunks that require TLS | [sip] listen_tls |
| inbound | https | 443 through the reverse proxy, path /sip (set by listen_ws, listen_wss) | SIP over WebSocket and secure WebSocket (browser softphone) | Browser softphones | [sip] listen_ws, listen_wss, trusted_proxies |
| inbound | udp | 10000-59999 (the rtpengine range; both directions use it) | Media (RTP and SRTP, audio and video) | Phones, softphones, browsers, trunks | rtpengine RTPE_PORT_MIN / RTPE_PORT_MAX |
| inbound | tcp+udp | 3478 (STUN and TURN); 5349 for TURN over TLS | Media relay for NAT traversal (STUN and TURN) | Browsers and softphones behind NAT | [ice] stun_urls, [ice] turn_urls |
| inbound | udp | 5060 to 224.0.1.75 (LAN only; not routed) | Plug-and-play phone discovery (multicast) | Desk phones on the same LAN segment | [provisioning] pnp_listener |
| internal | tcp | 9464 | Prometheus metrics, /healthz and /readyz | The monitoring host only; never published | [metrics] listen |
| internal | tcp | 5432 | Database (PostgreSQL) | The PBX services only | database connection string |
| internal | tcp | 6379 | Cache and bus (Valkey) | The PBX services only | cache connection string |
| internal | tcp | 8123 | Call history and analytics (ClickHouse HTTP) | The PBX services only | ClickHouse URL |
| outbound | https | 443 | Push notifications through the MonoPbx relay | The relay host (public address of the relay) | relay settings ([push]); not needed for air-gapped installs |
| outbound | https | 443 | Certificate authority (ACME) | The certificate authority | automatic certificates only |
| outbound | tcp+udp | 5060 (UDP, TCP) or 5061 (TLS), as the trunk says | SIP trunks and providers | The SIP provider | trunk settings |
| outbound | udp | 10000-59999 (source range) | Media to trunks and remote endpoints | The SIP provider and remote endpoints | rtpengine range |
| outbound | https | 443 | SMS over HTTPS providers and AI providers (bring your own key) | The provider's public HTTPS address | per provider settings |
| outbound | https | 443 (graph.facebook.com, api.telegram.org) | Messaging channels (Meta WhatsApp and Messenger, Telegram) | The channel provider; the provider calls back on the inbound HTTPS address | channel settings (omnichannel) |
| outbound | tcp | 2775 (default; set by the SMSC) | SMS over SMPP | The SMS centre | SMPP provider host, port |
| outbound | tcp | 587 (STARTTLS) or 465 (TLS) | Email (voicemail, notifications, reports) | The mail server | [email] SMTP settings or provider |
| outbound | tcp+udp | 53 | DNS lookups for SIP and certificates | The DNS resolver | host resolver |
| outbound | udp | 123 | Time synchronisation (recommended) | An NTP server; a local one is fine on an air-gapped site | host NTP service |
Each row names the configuration key that moves it. A feature that is switched off opens none of its rows.