Firewall Configuration for Single Server Mode

It is highly recommended to protect any MailStore Service Provider Edition service with appropriate firewall rules. This document should help with setting up the required rules.

Important Notices:

• The communication channels described below MUST NOT be intercepted by any kind of email or web proxies that are provided as part of antivirus software or unified threat management gateways.
• The Windows Advanced Firewall is activated on any Windows Server installation by default. In order to connect to services (e.g. MailStore Management Console) of the MailStore Service Provider Edition, it is required that the appropriate firewall rules are added (see below).

Firewall Rules For Single Server Mode

The table below lists all TCP ports that need to be opened in the firewall when using MailStore Service Provider Edition in single server mode. The following abbreviations are used in the source and target columns of that table:

• ANY = Any computer from private or public networks
• ADM = Computer or network used for administration
• SERVER = Server that hosts MailStore Service Provider Edition

A list of all TCP ports used by MailStore Service Provider Edition is available in the System Requirements

Port	Source	Target	Description
110	SERVER	ANY	Access to email servers for archiving via POP3 (Unencrypted/STARTTLS).
143	SERVER	ANY	Access to email servers for archiving via IMAP (Unencrypted/STARTTLS).
143	ANY	SERVER	IMAP access to archives secured by TLS (STARTTLS) encryption.
389	SERVER	ANY	Access to LDAP servers (including Microsoft Active Directory) using an unencrypted or STARTTLS-encrypted session.
443	SERVER	ANY	Access to Microsoft Exchange servers for archiving via Exchange Web Services (EWS) secured by SSL encryption.
443	SERVER	my.mailstore.com	Usage reporting and license update
443	ANY	SERVER	HTTPS access to instances used by MailStore Client, MailStore Outlook Add-in, MailStore Web Access and MailStore Mobile Web Access.
636	SERVER	ANY	Access to LDAP servers (including Microsoft Active Directory) using a SSL encrypted connection.
993	SERVER	ANY	Access to email servers for archiving via IMAP (SSL).
993	ANY	SERVER	IMAP access to archives secured by TLS (SSL) encryption.
995	SERVER	ANY	Access to email servers for archiving via POP3 (SSL).
8470	ADM	SERVER	Web-based access to the MailStore Management Console.
8474	ADM	SERVER	Access to the MailStore Management API.

Windows Advanced Firewall

The Windows Advanced Firewall can easily be re-configured for Single Server Mode. By executing the following commands in the Windows PowerShell command prompt, the required TCP ports are opened for inbound connections. Outbound connections to any destination are allowed by default.

# Allow access to CAS ports from everwhere
netsh advfirewall firewall add rule name="MailStore Service Provider Edition (CAS)" `
  action=ALLOW dir=IN protocol=TCP localport="143,443,993" profile=ANY

# Allow access to MailStore Service Provider Management Console from adminstrator network 192.0.2.0/24
netsh advfirewall firewall add rule name="MailStore Service Provider Edition (MGMT)" `
  action=ALLOW dir=IN protocol=TCP localport="8470" remoteip="192.0.2.0/24" profile=ANY

Firewall Rules For Multi Server Mode

The below table lists all TCP ports that need to be opened in the firewall when using MailStore Service Provider Edition in multi server mode. The following abbreviations are used in the source and target columns:

• ANY = Any computer from private or public networks
• ADM = Computer or network used for administration
• CAS = Server hosting Client Access Server role
• IH = Server hosting Instance Host role
• MGMT = Server hosting Management Server role

A list of all TCP ports used by MailStore Service Provider Edition is available in System Requirements

Port	Source	Target	Description
110	IH	ANY	Access to email servers for archiving via POP3 (Unencrypted/STARTTLS).
143	IH	ANY	Access to email servers for archiving via IMAP (Unencrypted/STARTTLS).
143	ANY	CAS	IMAP access to archives secured by TLS (STARTTLS) encryption.
389	IH	ANY	Access to LDAP servers (including Microsoft Active Directory) using an unencrypted or STARTTLS-encrypted session.
443	IH	ANY	Access to Microsoft Exchange Server for archiving via Exchange Web Services (EWS) secured by SSL encryption.
443	ANY	CAS	HTTPS access to instances used by MailStore Client, MailStore Outlook Add-in, MailStore Web Access and MailStore Mobile Web Access.
443	MGMT	my.mailstore.com	Usage reporting and license update
636	IH	ANY	Access to LDAP servers (including Microsoft Active Directory) using a SSL encrypted connection.
993	ANY	CAS	IMAP access to archives secured by TLS (SSL) encryption.
993	IH	ANY	Access to email servers for archiving via IMAP (SSL).
995	IH	ANY	Access to email servers for archiving via POP3 (SSL).
8470	ADM	MGMT	Web-based access to the MailStore Management Console.
8470	IH, CAS	MGMT	Optional: Required for initial pairing with Management Server. If not available, manual registration of Instance Hosts and Client Access Servers in Management Server is required.
8471	CAS, IH	MGMT	Internal communication with Management Server
8472	MGMT, CAS	IH	Internal communication with Instance Hosts
8473	MGMT	CAS	Internal communication with Client Access Servers

What to do next

In environments where the single server mode is sufficient, the setup procedure continues with configuration of MailStore Service Provider Edition as described in Single Server Mode Setup.

In environments where a multi server mode setup is planned, deploy and install MailStore Service Provider Edition as described above on all other machines before continuing the setup process with the configuration of the Management Server role as described in Multi Server Mode Setup.