What ports should I expose in the FW?

I will try to answer this as best I can. If anyone has any additions or corrections, please add them…

• Port 25 is used for server-to-server communication, i.e. to receive mail from other servers, so it must remain open.

• 4190 is used to manage email filters remotely from a client. If you don’t need that feature or you always set the filters directly on the server e.g. via Sogo or Roundcube, the port can be closed.

• 465 or 587 is used to connect clients via SMTP. 587 uses STARTTLS, 465 uses implicit TLS. The latter is a bit more secure. So this is up to you, what you want to use. I have both ports open, for maximum compatibility with different clients.

• 993 vs 995: IMAP is “better” than POP3 in the sense that it synchronizes emails. That means you have always the same messages and folders on all clients and the messages always stay on the server. If you use POP3, the client can only download messages and you can decide whether the mails will be deleted on the server or not. So it depends on your use case which is better. But yes, if you don’t intend to use POP3, you can close the corresponding ports.

• And just for the sake of completeness: You don’t need to open ports 110 and 143 because clients that can only connect unencrypted should not be used anyways.