Firewall / Ports

[rhostager]

I was looking over the latest requirements for M3. I have had a test server running from M1 to M3 and am getting ready to put a production server online.

The QuickStart Guide lists the following ports:

Table 1 Zimbra Port Mapping

Postfix 25
HTTP 80
POP3 110
IMAP 143
LDAP 389
HTTPS 443
Tomcat IMAP SSL 993
Tomcat POP SSL 995
Tomcat LMTP 7025

Questions: I need to know what ports need to be open to the Internet. Port 7071 is not listed but I know that one needs to be included if I want to administer when off my local network. What about LMTP 7025? Should this be open to the Internet as well or just the local network? Are there any other ports that need to be open?

- Rob

[marcmac]

Which ports to open depend partly on the services you offer - if you're not offering un-encrypted IMAP, for instance, don't bother opening 143.

One thing to think about, tho - if your host knows itself by it's public name (mail.whatever.com) which resolves to the public IP on the fw - make sure the fw allows connections from the private ip on the box (192.168.foo.bar) to the public IP on all the ports. (esp. ldap (389) and sql (7306/7307))

[KevinH]

Here at Zimbra we open 25 for mail and the SSL service ports:

HTTPS 443
Tomcat IMAP SSL 993
Tomcat POP SSL 995

[UniqueFD]

Originally Posted by marcmac

... One thing to think about, tho - if your host knows itself by it's public name (mail.whatever.com) which resolves to the public IP on the fw - make sure the fw allows connections from the private ip on the box (192.168.foo.bar) to the public IP on all the ports. (esp. ldap (389) and sql (7306/7307))

Just wanted to say thanks, marcmac, for the above info. I recently migrated to Zimbra (Open Source edition) and all works great from inside our network, but my external clients could not add attachments - until I set my firewall to forward ports 7306 & 7307, as you suggested above. Works a treat now.

Cheers,


UniqueFD