bongo/docs/ports.md

Network ports

The table lists the current defaults. Every listener is configurable, and an entry being compiled does not mean that it is enabled in a particular installation.

Port	Protocol	Default exposure	Notes
25/TCP	SMTP	Public when receiving Internet mail	Opportunistic STARTTLS; relay policy applies.
26/TCP	Trusted-device SMTP relay	Disabled	Restricted IPv4/CIDR allowlist and rate limits; never an open relay.
465/TCP	Implicit-TLS SMTP submission	Optional	Authenticated clients; configured as the implicit submission listener.
587/TCP	SMTP submission	Wizard-enabled	STARTTLS and authentication for user clients.
110/TCP	POP3	Optional	Prefer STLS or port 995; clear-text compatibility needs explicit policy.
995/TCP	POP3S	Optional	Implicit TLS.
143/TCP	IMAP	Enabled by the base template	STARTTLS; login is disabled before TLS under the secure default.
993/TCP	IMAPS	Enabled by the base template	Implicit TLS.
4190/TCP	ManageSieve	Wizard-enabled	STARTTLS plus SASL; may be limited to the user network.
80/TCP	Bongo Web redirect	Direct-HTTPS mode only	Permanently redirects to the configured public HTTPS URL.
443/TCP	Bongo Web HTTPS	Direct-HTTPS mode only	Binds and loads the private key before permanently dropping to the bongo user.
8080/TCP	Bongo Web	Loopback only	Normally proxied by Apache or nginx with external HTTPS.
689/TCP	Bongo Store protocol	Private	Internal agent interface; do not expose.
8670/TCP	Bongo Queue protocol	Private	Internal agent interface; do not expose.

ClamAV port 3310 and SpamAssassin port 783 belong to those external scanner services, not to Bongo. Keep them on loopback or a tightly controlled service network.

Firewall and NAT

NAT may map the same internal server address to public SMTP, submission, IMAP, POP3, and Web ports. It does not change Bongo's listener policy. For example, public port 25 and private port 26 can both reach the same server IP because they are separate TCP listeners with separate trust rules.

Expose only the protocols required by the deployment. A common public set is 25, 465 or 587, and 993. Port 443 normally terminates at the chosen Web reverse proxy; the proxy then connects to Bongo's loopback port 8080. In direct-HTTPS mode Bongo binds 443 itself and also binds port 80 solely for a safe redirect to the configured public_base_url. POP3 and ManageSieve can remain private when no client needs them.

If HAProxy or another TCP load balancer fronts mail listeners, enable PROXY protocol only for its exact source addresses. If the proxy cannot speak PROXY protocol, do not trust a client-supplied mail header as an equivalent. See proxy-protocol.md.

Bongo 0.7 mail listeners are IPv4. Opening IPv6 firewall rules does not add IPv6 support; coherent IPv6 handling is scheduled for 0.9.