Ports blocked on VPS - Application Role - Enhance Control Panel

Ports blocked on VPS - Application Role

MediaLabz

I want to use a VPS for the Application and Database Role that has the following ports blocked:

25/tcp/udp
465/587/389/3389/tcp
111/udp
137/138/139/tcp/udp
445/tcp/udp
I am using another server for the Mail Role. Would this have any effect on sending mail or any other functionality for websites hosted on the VPS?

rdbf

Yes. None of the websites on that server will be able to send email via the standard ports, assuming these blocks are outgoing. They simply can't reach any server on any of these ports. Unfortunately this is more and more common with VPS providers.

Since Enhance's postfix only listens on the standard ports, you'll either have to make it listen on nonstandard ports or use an external SMTP relay that uses a nonstandard port.

nhybgtvfr

blocking most of those ports should, in general, be fine, especially if you don't want your websites on that server to send unauthenticated outbound email directly to external mailservers (port 25).
i would personally allow port 25 to a central (local network) mailserver to allow system mails to be sent out.
and allow outbound connections to port 587 (any destination ip) so any websites can send out mail using authenticated smtp even via external mailservers.

you could also block ports 143/993 (imap) and 110/995 (pop3) inbound, again only allowing that server to connect to your central mailserver for any webmail interface running on that server (should only need imap and smtp (port 587) )

MediaLabz

Anyone with experience in this that can give some guidance?

webnestify

MediaLabz What guidance do you seek? You should never sent emails from server where you are hosting websites. If site got blacklisted, it will also affect IP address of the server and vice-versa.

Many providers don't even offer this because they know it can be abused or admins who are doing bad job managing email server.

In Hetzner you can ask and open ticket to open email sending ports.But you need to have valid reason and be customer in good standing.

Who is your server provider?

Install email role on separate server or use dedicated email stack: https://youtu.be/fgEWUsYPd9M . Very good.

MediaLabz

As mentioned in my initial post, email is on a separate server.

I would like to know if the blocked ports on the application server will affect sending emails through php for example, or affect services in any other way.

webnestify

MediaLabz If you set custom SMTP, then no.

rdbf

As per Adam, for the ticket I submitted a while ago about this:

If your server provider will not allow port {25/465/587}, you can work around this with a smart host provider. Their relay will listen on a non-standard port

If you're sending mail with WordPress through your own server (which has a smart host configured) then you don't need to use an SMTP plugin, just use PHP mail(). This will obey the smart host setting on the web server.

So for your case:

MediaLabz I would like to know if the blocked ports on the application server will affect sending emails through php for example, or affect services in any other way.

Yes. If email ports are blocked outgoing, the only way to make this work is to set a smart host (internal or external) for that server that listens on a non-standard port. In our case, we made sure the Enhance email role also listens on non-standard ports.