Outgoing network traffic using random ports. SOGo webmail access.

totalinfra

Hello friends, I’m new here.

I have a technical question that I haven’t been able to clarify yet, so I want to share and see if anyone can help me.

I’m using Mailcow in Docker on an Oracle server. Everything worked perfectly, I followed the instructions and information on the official website and managed to get everything working.

However, I want to improve security on the server, and for that I want to block some outgoing ports (Egress) in the firewall. I noticed that all communication coming to SOGO Webmail, using the HTTPS port (TCP443), responses are being sent on random high ports. I intended to block Internet egress only to port 443, and I can’t because of these responses on random ports.

Wouldn’t it be correct for the response to requesters to be sent via port 443 as is done at the entrance?

I have the impression that this is because the docker network structure is in Bridge mode, but I’m not sure.

I use Traefik as a front, to make Ingress for SOGo Webmail.

Has anyone analyzed or has the same case as mine?

I would be happy to know if there is a way to fix this.

Thank you all.

Rafael Matias

DocFraggle

totalinfra Wouldn’t it be correct for the response to requesters to be sent via port 443 as is done at the entrance?

It is sent via port 443, but the destination port is a random port, that is normal TCP behavior! The client (browser) selects a random port >1023 (let’s take 1632 as examples) as source port for it’s request and sends it to port 443 of your mailcow server. The response is then sent back to the client to port 1632 in our example.

You should read about and understand TCP before you try to set up your firewall

totalinfra

Hello DocFraggle,

Thank you for your answer, perhaps the translation changed the meaning of my previous question a little, but my difficulty was related to the Stateful VS Stateless model in Firewall.

When I switched to Stateful mode, I was able to respond successfully as open calls coming from port 443, facing random outgoing ports, are mapped and can be answered.

Thanks