Mario Fetka
49 lines
2.9 KiB
Markdown
49 lines
2.9 KiB
Markdown
# Network ports
|
|
|
|
The table lists the current defaults. Every listener is configurable, and an
|
|
entry being compiled does not mean that it is enabled in a particular
|
|
installation.
|
|
|
|
| Port | Protocol | Default exposure | Notes |
|
|
| ---: | --- | --- | --- |
|
|
| 25/TCP | SMTP | Public when receiving Internet mail | Opportunistic STARTTLS; relay policy applies. |
|
|
| 26/TCP | Trusted-device SMTP relay | Disabled | Restricted IPv4/CIDR allowlist and rate limits; never an open relay. |
|
|
| 465/TCP | Implicit-TLS SMTP submission | Optional | Authenticated clients; configured as the implicit submission listener. |
|
|
| 587/TCP | SMTP submission | Wizard-enabled | STARTTLS and authentication for user clients. |
|
|
| 110/TCP | POP3 | Optional | Prefer STLS or port 995; clear-text compatibility needs explicit policy. |
|
|
| 995/TCP | POP3S | Optional | Implicit TLS. |
|
|
| 143/TCP | IMAP | Enabled by the base template | STARTTLS; login is disabled before TLS under the secure default. |
|
|
| 993/TCP | IMAPS | Enabled by the base template | Implicit TLS. |
|
|
| 4190/TCP | ManageSieve | Wizard-enabled | STARTTLS plus SASL; may be limited to the user network. |
|
|
| 80/TCP | Bongo Web redirect | Direct-HTTPS mode only | Permanently redirects to the configured public HTTPS URL. |
|
|
| 443/TCP | Bongo Web HTTPS | Direct-HTTPS mode only | Binds and loads the private key before permanently dropping to the `bongo` user. |
|
|
| 8080/TCP | Bongo Web | Loopback only | Normally proxied by Apache or nginx with external HTTPS. |
|
|
| 689/TCP | Bongo Store protocol | Private | Internal agent interface; do not expose. |
|
|
| 8670/TCP | Bongo Queue protocol | Private | Internal agent interface; do not expose. |
|
|
|
|
ClamAV port 3310 and SpamAssassin port 783 belong to those external scanner
|
|
services, not to Bongo. Keep them on loopback or a tightly controlled service
|
|
network.
|
|
|
|
## Firewall and NAT
|
|
|
|
NAT may map the same internal server address to public SMTP, submission,
|
|
IMAP, POP3, and Web ports. It does not change Bongo's listener policy. For
|
|
example, public port 25 and private port 26 can both reach the same server IP
|
|
because they are separate TCP listeners with separate trust rules.
|
|
|
|
Expose only the protocols required by the deployment. A common public set is
|
|
25, 465 or 587, and 993. Port 443 normally terminates at the chosen Web
|
|
reverse proxy; the proxy then connects to Bongo's loopback port 8080. In
|
|
direct-HTTPS mode Bongo binds 443 itself and also binds port 80 solely for a
|
|
safe redirect to the configured `public_base_url`. POP3 and ManageSieve can
|
|
remain private when no client needs them.
|
|
|
|
If HAProxy or another TCP load balancer fronts mail listeners, enable PROXY
|
|
protocol only for its exact source addresses. If the proxy cannot speak PROXY
|
|
protocol, do not trust a client-supplied mail header as an equivalent. See
|
|
[proxy-protocol.md](proxy-protocol.md).
|
|
|
|
Bongo 0.7 mail listeners are IPv4. Opening IPv6 firewall rules does not add
|
|
IPv6 support; coherent IPv6 handling is scheduled for 0.9.
|