RTFM · Networking

MailDragon and webDragon ports

Ports describe transport endpoints, not security. Publish only listeners you need and verify the generated configuration.

MailDragon

25/TCP: SMTP server-to-server delivery.
465/TCP: submission with implicit TLS.
587/TCP: message submission, commonly with STARTTLS.
143/TCP: IMAP, commonly upgraded with STARTTLS.
993/TCP: IMAP with implicit TLS.
110/TCP: POP3, commonly upgraded with STARTTLS.
995/TCP: POP3 with implicit TLS.

MailDragon may not enable every listener in every deployment. Confirm Postfix and Dovecot configuration before opening a port.

webDragon

80/TCP: HTTP, often needed for redirects and ACME HTTP validation.
443/TCP: HTTPS web traffic.

If HAProxy sits in front, the router forwards 80 and 443 to HAProxy and HAProxy forwards to the internal webDragon address. If webDragon is public directly, the router or provider firewall forwards to its listener instead.

Verify listeners

Listener checks

ss -lntup
ss -lntp '( sport = :25 or sport = :443 )'
# Check the generated MailDragon/webDragon configuration
# Then test from LAN and from an independent external network

A listening port is not automatically a public port

A daemon can listen on loopback only, a private server VLAN, all IPv4 addresses, all IPv6 addresses, or a proxy-facing interface. The router/provider firewall decides whether traffic reaches the edge; nftables decides whether it may continue; HAProxy may own the public port instead of the application. Always identify the owning process and listening address before adding any forwarding rule.

Read ss before publishing a service
Observed listener	Meaning	Correct response
127.0.0.1:443	Local-only HTTPS listener.	Keep it private or proxy to it locally; a router forward cannot reach it directly.
192.168.20.30:443	Private server-VLAN listener.	Use HAProxy or controlled routed access; do not publish the private address in public DNS.
0.0.0.0:443 / [::]:443	Listens on all addresses in that family.	Use nftables and interface-bound proxy configuration to constrain exposure.
HAProxy owns :443	The proxy is the public TLS edge.	Let its backend and trusted-header design determine the application path.

Port, address family, and TLS proof

# List TCP listeners with program owners.
ss -lntp

# Check whether a process owns each address family.
ss -lntp4 '( sport = :443 )'
ss -lntp6 '( sport = :443 )'

# Test protocol/TLS from a separate network.
openssl s_client -connect www.example.test:443 -servername www.example.test
openssl s_client -starttls smtp -connect mail.example.test:587 -servername mail.example.test

Changing an external port to an unusual number does not make an administration service safe. Prefer a management VPN and source-restricted firewall policy. If you use a non-standard external port for a temporary purpose, document it and still test the actual protocol path.

Expose MailDragon and webDragon in the right order

1. Choose the public identity
For web, decide the hostname and HTTPS certificate owner. For mail, decide the MX hostname and the actual outbound sending address/PTR identity.
2. Prove the backend
Test webDragon locally or from its server VLAN. Test MailDragon's intended SMTP/submission/IMAP listeners and TLS locally before making any route public.
3. Choose direct or HAProxy edge
A direct host owns the public port itself. HAProxy owns the public port and forwards to the backend; this requires a backend firewall that trusts the proxy path only.
4. Open matching boundaries
Add precise provider/router delivery and nftables rules. For IPv6, write firewall policy; do not add IPv4 DNAT expecting it to apply.
5. Prove from outside
Use a remote network, the public hostname, and a protocol-aware test. Then verify that an unlisted port and private management port remain unavailable.