Firewall port (intranet) to open fort multi server setup ?

Discussion in 'Installation/Configuration' started by ledufakademy, Aug 14, 2020.

  1. ledufakademy

    ledufakademy Member

    Here, the port i will open on each of my ISPconfig setup ...

    WEBMaster (panel)
    • 22(ssh) (bastion ssh)
    • 8080 (http/s)(any)
    • 3306 (mysql) (from other ispconfig server)
    WEB
    • 80,443 (http/s)(any)
    • 21(ftp)(any)
    • 22(ssh)(any)
    DATABASE
    • 22(ssh)(bastion ssh)
    • 3306 (mysql) (from other ispconfig server)
    DNS
    • 22(ssh)(bastion ssh)
    • 53(dns)(any)
    MAIL
    • 22(ssh)(bastion ssh)
    • 25 (smtp)(relay host)
    • 587 (submission) ( any)
    • 995 (pop3s) (any)
    • 993(imaps) (any)
    i'm i right ?
     
    Last edited: Aug 19, 2020
  2. ahrasis

    ahrasis Well-Known Member

  3. nhybgtvfr

    nhybgtvfr Active Member

    you may want to include ports 110, 143, and 465 for mail
    they may not be needed, but can you confirm 100% that any clients/client software will not need less secure mail access?
    i know of several customers who insist on still using ancient mail client software (really really old versions of outlook, eudora etc.), refusing to upgrade, and their software will not support the latest ssl/tls standards.

    also port 8080 for the control panel, if you plan on running any other of your own (non-customer) sites on the WEBmaster server, it would still be recommended to keep the control panel on it's own dedicated port.
    you may also want to allow ports for ntp / whois etc, along with icmp so that ping/echo etc work.
    may not want them open all the time, but they're very useful when troubleshooting.

    also if you're using anything for domain registrations, eg whmcs linked to ispconfig, then depending on what domain registration authorities you use, you may need to open ports for them, eg opensrs api uses ports 55443 and 55000
     
  4. ledufakademy

    ledufakademy Member

    thank, but i want to know how ispconfig is working in multi server...with master , web server databse etc . tcp/udp flow ...
    for example, can i close mysql incoming traffic on dns server ?
    that suppose that dns server pull is config from master server .
    but if dns receive it from master, i must open 3306 port from master server ...
     
  5. nhybgtvfr

    nhybgtvfr Active Member

    all slave ispconfig servers will query the dbispconfig database on the master ispconfig server every minute.
     
  6. ahrasis

    ahrasis Well-Known Member

    TDP/UCP is mentioned in the link I posted. And yes, mysql port must be kept opened but it does not necessarily need to be on default port 3306 thus you should be able to change to other than default.
     
    Last edited: Aug 19, 2020
  7. ledufakademy

    ledufakademy Member

    so only, master server has to be open with 3306 for incoming traffic.
    others servers can closed (for incoming trafic ) their 3306 port .
    that's it ?
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    yes. Plus database server nodes of course.
     
  9. ledufakademy

    ledufakademy Member

    of course db server.
    thank you till, that sound good for me.
     
  10. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    And it does not need to be open for the whole internet, only for your slave servers' IP addrs.
     
    ledufakademy likes this.
  11. ledufakademy

    ledufakademy Member

    sure.;);)
    this is why i mentionned : "from other ispconfig server"
     
    Last edited: Aug 19, 2020

Share This Page