Firewall Configuration

Deploy the ExaVault virtual appliance behind a firewall. Allow only the services that your users and administrators need, and restrict administrative ports to trusted networks.

Inbound Traffic From the Public Internet

Expose a protocol only when external clients use it.

Port	Purpose	When to Allow It
80	HTTP redirect and automatic-certificate validation	Allow when using automatic SSL certificate management.
443	ExaVault web interface and WebDAV over HTTPS	Allow when external users need the web interface or WebDAV.
21	Plain FTP or explicit FTPS	Allow when external clients use either protocol.
22	SFTP and SCP	Allow when external clients use SFTP or SCP.
990	Implicit FTPS	Allow when external clients use implicit FTPS.
40000-49999	Passive FTP and FTPS data connections	Allow the entire range whenever external clients use FTP or FTPS in passive mode.
ICMPv4	Network reachability checks	Allow when your network-monitoring policy permits it.

Plain FTP on port 21 is unencrypted. Prefer SFTP or FTPS when the client supports an encrypted protocol.

Inbound Traffic From the Internal Network

The same protocol ports apply to internal clients. In addition, administrators may need these ports:

Port	Purpose	Access Guidance
10022	Appliance SSH and support sessions	Restrict to trusted administrative source addresses.
9002	Appliance Manager over HTTPS	Restrict to trusted administrative source addresses.

Do not expose ports 10022 or 9002 broadly to the public Internet.

Outbound Traffic

Port	Purpose	Required
53	DNS resolution	Yes
80	Appliance updates and related downloads	Yes
443	Appliance updates and HTTPS services	Yes
389	LDAP	Only when using an LDAP server on this port
636	LDAPS	Only when using an LDAPS server on this port

Also allow outbound traffic to the SMTP host and port configured for Sending Email. If you use a private LDAP or SMTP service, route that traffic according to your internal network policy rather than exposing it to the public Internet.