Ports and firewall

Since 08.10.2026 the calendar and identity roles are one role, directory: one service, the role's name dir.<domain> (directory, console, portal, the calendar under /cal, CalDAV on the name's root), both private ports.

Applies to: SimpleTwo 0.9.x · Checked: 02.10.2026

Firewall rules on role hosts are set by the agent itself, from the same description it installs the service from. This page is for the case where another firewall sits between your networks: that one is configured by you, not by the agent.

1. What must be reachable from the internet

Role	Port	Why
coordinator	80/tcp	domain-validation challenge (ACME) and the redirect to HTTPS
coordinator	443/tcp	API, console, the client download page
messaging	9090/tcp or 443/tcp	clients; 443 when the service terminates its own TLS
directory	443/tcp	sign-in (OpenID Connect, SAML), the person's portal /me, /admin — a redirect to the coordinator's console, the calendar /cal (subscriptions), CalDAV and CardDAV /dav/; opened only when the host has a public name — its own, or through the organisation's NAT
mail	443/tcp	mail for the clients (JMAP and its push); opened only when the host has a public name
sfu	443/tcp	signalling when the node sits behind a TLS edge
sfu	7880/tcp	signalling directly — opened only when there is no edge
sfu	7881/tcp	media fallback over TCP
sfu	50000–60000/udp	the streams themselves
turn	3478/udp + 3478/tcp	NAT traversal
turn	443/tcp	the same over TLS (turns:) — for networks that leave only HTTPS open; opened only once the certificate is on disk
turn	49152–65535/udp	relay
mcu	5061/tcp	SIP over TLS (_sips._tcp) — the way in for meeting-room terminals; opened only once the node has a public name and its certificate is on disk — the coordinator orders it
mcu	5060/udp + 5060/tcp	open SIP — only with the device transport «TLS and open SIP»; closed by default (see below)
mcu	80/tcp	only while the SIP-TLS certificate is being issued (the domain-validation challenge)
mcu	10000–20000/udp	media: voice, video, presentation, BFCP over UDP
mcu	10000–20000/tcp	presentation control (BFCP over TCP): the device connects to the MCU; from agent 0.5.76
gateway	443/tcp and the ports of enabled transports	client tunnels
monitoring	443/tcp	the way into the monitoring interface — the only port people reach; where it is visible from (the internet or only your network) is your choice
monitoring	80/tcp	only while a certificate is being issued (the domain-validation challenge)
mx	25/tcp	mail from the internet (MX) and messages from password-less devices in the networks set in the console; the agent opens it itself. Whether mail from the internet arrives here is decided by the MX record in your DNS
drive	443/tcp	files for clients and external links /d/…; the service obtains its certificate there itself (TLS-ALPN-01). Opened only when the host has a public name (see files)
mx	587/tcp, 465/tcp	submission with an app password: 587 is STARTTLS, 465 is TLS; opened only when the host has a public name and a certificate

5060 is closed on mcu by default. Whether it opens is the setting Telephony → SIP SRV records → Device transport (in detail — meeting rooms, section «Device transport»):

• «TLS only» (the default) — the node does not listen on 5060 and the agent closes it in the firewall. A device comes in over SIP-TLS: by its own certificate, or, as the exception, with a user name and password (SIP digest with SHA-256).
• «TLS and open SIP» — 5060 UDP and TCP is open. Only devices that cannot speak SIP-TLS at all need it: plain SIP carries no certificate, so such a device can sign in only with a user name and password.

«TLS only» takes effect only once SIP-TLS is up: with no certificate on disk 5060 stays open and the node reports why. A node that listens nowhere is worse than one that listens in the clear.

There are two mx nodes by design, each with its own public address — the ports are the same on both. Until your DNS has an MX record pointing at an mx node, no mail from the internet comes in; more in mail.

A port opens when there is something behind it to answer

This is a rule rather than a configuration detail: turn does not announce TLS on 443 until it has a certificate, mcu does not announce 5061 until its certificate is on disk, and directory, mail and drive do not open 443 until the host has a public name. A port that accepts a connection and cannot finish the handshake is read by a carrier as our fault and by a scanner as an invitation.

2. What must not be reachable from the internet

Role	Port	Open it to
postgres	5432/tcp	only the hosts of the services that use it
redis	6379/tcp	only messaging, sfu, mcu, recorder
s3	9000/tcp	only messaging and recorder; it listens on one private leg, not on every interface
support	8087/tcp	only the messaging hosts, and only signed webhooks; the agent opens the port to them only
messaging	9091/tcp	the control API: loopback only by default
directory	8086/tcp	the coordinator: the private HTTP the console writes to identity through
mail	8087/tcp	the coordinator and the platform's services: private HTTP
mail	24/tcp	LMTP — the door mx hands mail in through; only the mx hosts
mail	8087/tcp	the mx hosts too: the edge takes its list of recipients from there
mx	2525/tcp	only the mail nodes: the cluster hands its outbound mail to the edge there
drive	8088/tcp (the default; the console's listen setting changes it)	the files' private HTTP for the coordinator and services; clients use 443 on the public name
directory (calendar)	8085/tcp	the coordinator and the platform's services: private HTTP

From agent 0.5.111 the roles' internal HTTP — by default directory 8085 and 8086, mail 8087 and LMTP 24, mx 2525, drive 8088 — listens on the host's private address only, when the host holds it; otherwise on every interface, with the reason in the agent's log. The allow-lists (redis, s3, monitoring 4319, postgres, mail 24, mx 2525, support) are reconciled by the agent, which drops sources that are gone; rules written by agents before 0.5.111 stay until removed by hand. | monitoring | 4319/tcp | telemetry from the other hosts, on the private address. The agent opens it only to the addresses of the hosts that send, and a request without the token is refused |

On loopback (127.0.0.1) only, and never opened outward: the services' /metrics — coordinator 9101, messaging 9091, directory 9103, support 9104, mail 9105, mx 9106, drive 9107, the mx admin listener 8088; on the monitoring host its stores 8428, 9428, 10428 and Grafana 3000; on every host with a telemetry collector, 4318.

On the bus and storage hosts a firewall is mandatory

Neither redis nor s3 has authentication strong enough to stand open even on a private network: the boundary is the firewall rule. Installing the s3 role on a host without one is refused rather than leaving the store open.

3. Outbound

To	Port	Who and why
Let's Encrypt	443/tcp	the coordinator and the services that issue their own certificates
GitLab / image registry	443/tcp	updates and agent distribution
APNs, FCM	443/tcp	messaging — pushes to devices
model provider	443/tcp	messaging — the AI lane, when it is enabled
the organisation's sign-in provider (ADFS, Entra, Keycloak)	443/tcp	the coordinator and directory — signing in through it
AD or another LDAP directory	389/tcp or 636/tcp	the coordinator and directory — reading people and groups
the recipients' mail servers	25/tcp	mx — sending out: by the recipient's MX record, with STARTTLS when the server offers it
the monitoring host	4319/tcp, private network	the collector on every host with a private address — telemetry
dl.grafana.com	443/tcp	the coordinator, once: the Grafana archive for the monitoring host, checked against the hash in the image
meeting-room terminals (Poly, Cisco)	5061 (5060 only with «TLS and open SIP») + 10000–20000 to the mcu host	inbound to mcu
the carrier's SIP trunk	5060/5061 + RTP	the pstn role, the PSTN gateway; not mcu
role hosts	22/tcp	only hosts provisioned over SSH. A host enrolled with the join command needs no inbound SSH: its agent fetches its own state from the coordinator

4. How to check

# is the role listening at all (on the host itself)
ss -tlnp | grep -E ':(24|25|443|465|587|2525|7880|7881|9090|8085|8086|8087|8088|5060|9000|4319)\b'

# is it visible from outside
nc -z -w 5 <address> 443 && echo ok

"From inside" and "from outside" answer different questions: the agent watches whether anything is listening on the host, the coordinator's console whether a client can reach it. A host that fails the first is misconfigured; a host that fails the second is unreachable.