Firewall/NAT Ports

[Jes]

What ports need to be open on the firewall/NAT system to allow the Zimbra product to work on the world wide web. I have Zimbra working perfectly on my LAN, however, I get the following application error when accessing it from the web:

An unknown application error has occurred. Please correct any errors and retry. If the problem persists, please contact your System Aministrator. (service.FAILURE)

I have read other postings about need serveral 7000 ports open. I just want to know for sure which ports to open so I do not compromise security.

Thanks in advance.

[marcmac]

is this in the browser? Are you using http, or https? Do you need the admin console available from the web?

Did you read the documentation available?

All you need for webmail is port 80 or 443.

[Jes]

The error was in the browser. I can use both user and admin interface from lan. I can also use the admin interface fine from the outside on port 7071. I am using a dyndns.org domain for the outside. I am unsure if this would cause problems.
I am also mapping port 10001 to port 80 from the my firewall/router.
Port 10001 outside goes to port 80 on the linux box inside.
I also have port 443 and port 7071 pointing to the linux box.

The reason I am using port 10001 outside for conversion is because I have several servers running off my dyndns all using port 80. I user different points on the outside to meet up with port 80 on the correct machine on the inside.

I hope this makes since.

[phoenix]

I don't know if the way you've forwarded port 10001 to 80 causes zimbra a problem but you could change the listening port on zimbra by doing this

[Jes]

I will try this.

Thanks,
Jes

[marcmac]

This will be a problem, since the zimbra client will be referred to port 80 after you log in.

[dijichi2]

ah yes, the port seems to get hardcoded in the javascript based on the server setting rather than url requested. i have zimbra http running on port 85 on one server because i already have an apache running on port 80 and was trying to use proxy to pass through something like this (excuse the syntax if wrong, i was trying all sorts of different things to get it to work):

# ProxyPass /email/ http://www.ijichi.org:85/
# RewriteEngine On
# RewriteCond %{HTTP_REFERER} ijichi.org/email
# RewriteCond %{REQUEST_URI} !^/email
# RewriteRule ^/(.*)$ http://www.ijichi.org/email/$1 [L,P]

it would be lovely to be able to do this, as lots of desktops have anything other than port 80 blocked.

[marcmac]

we've got a bug open on this (don't remember the number) - it's slated for the 1/31 release.

[Jes]

Thank you for the update. This would make since why the 10001 was not working as it would not have been able to communicate on port 80 after the intial login. This also explains why the admin console worked fine as it uses 7071 and this is what I was using on the WAN side.

Thanks,
Jes

[g8se]

Anyone know if this issue got fixed? I've just setup a test install with an apache on :80, and zimbra on :81, and proxying through didn't seem to work.

The proxy did work, I could look at the source page and see html, and javascript code.

However I saw this sort of code:

script type="text/javascript" src="/js/msgs/I18nMsg,AjxMsg,ZMsg,ZmMsg.js.zgz?v=060829134041" /script