5060 is standard SIP registration, since you are using VPN and the traffic is seen as "local".
Https - 5001 is for provisioning normally external endpoints so for local provisioning you are normally looking at port 5000. https://www.3cx.com/docs/ports/ if you have kept everything as default.