snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

docs/main/deployment-guide/server/prepare-network.mdx

@@ -0,0 +1,147 @@
+---
+title: "Network ports and outbound proxy"
+sidebar_label: "Prepare your network"
+---
+Open the ports Mattermost needs before you install, and note the outbound destinations your deployment will reach. If your environment blocks direct outbound access, configure an outbound proxy at the same time.
+
+## Network ports
+
+The following table outlines the network ports and protocols required for Mattermost server:
+
+<table style={{width: '98%'}}>
+<colgroup>
+<col style={{width: '26%'}} />
+<col style={{width: '17%'}} />
+<col style={{width: '15%'}} />
+<col style={{width: '5%'}} />
+<col style={{width: '5%'}} />
+<col style={{width: '27%'}} />
+</colgroup>
+<thead>
+<tr>
+<th>Service Name</th>
+<th>Config Setting</th>
+<th>Port (default)</th>
+<th>Protocol</th>
+<th>Direction</th>
+<th>Info</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>HTTP/Websocket</td>
+<td>ServiceSettings.ListenAddress</td>
+<td>8065/80/443 (TLS)</td>
+<td>TCP</td>
+<td>Inbound</td>
+<td>External (no proxy) / Internal (with proxy) Usually this requires port 80 and 443 when running HTTPS.</td>
+</tr>
+<tr>
+<td>Cluster</td>
+<td>ClusterSettings.GossipPort</td>
+<td>8074</td>
+<td>TCP/UDP</td>
+<td>Inbound</td>
+<td>Internal</td>
+</tr>
+<tr>
+<td>Metrics</td>
+<td>MetricsSettings.ListenAddress</td>
+<td>8067</td>
+<td>TCP</td>
+<td>Inbound</td>
+<td>External (no proxy) / Internal (with proxy)</td>
+</tr>
+<tr>
+<td>Database</td>
+<td>SqlSettings.DataSource</td>
+<td>5432 (PostgreSQL) / 3306 (MySQL)</td>
+<td>TCP</td>
+<td>Outbound</td>
+<td>Usually internal (recommended)</td>
+</tr>
+<tr>
+<td>LDAP</td>
+<td>LdapSettings.LdapPort</td>
+<td>389</td>
+<td>TCP/UDP</td>
+<td>Outbound</td>
+<td></td>
+</tr>
+<tr>
+<td>S3 Storage</td>
+<td>FileSettings.AmazonS3Endpoint</td>
+<td>443 (TLS)</td>
+<td>TCP</td>
+<td>Outbound</td>
+<td></td>
+</tr>
+<tr>
+<td>SMTP</td>
+<td>EmailSettings.SMTPPort</td>
+<td>10025</td>
+<td>TCP/UDP</td>
+<td>Outbound</td>
+<td></td>
+</tr>
+<tr>
+<td>Push Notifications</td>
+<td>EmailSettings.PushNotificationServer</td>
+<td>443 (TLS)</td>
+<td>TCP</td>
+<td>Outbound</td>
+<td></td>
+</tr>
+</tbody>
+</table>
+
+<Note>
+
+- All outbound ports may vary based on your specific configuration
+- Mattermost can be configured to use an outbound proxy for any HTTP/HTTPS traffic (see below)
+- Calls service may require additional ports. See the [Calls deployment guide](/deployment-guide/calls/calls-deployment-guide) for details.
+
+</Note>
+
+Only the inbound ports your readers actually reach need to be exposed externally. When Mattermost runs behind [an NGINX reverse proxy](/deployment-guide/server/setup-nginx-proxy), expose 80 and 443 at the proxy and keep 8065, 8067, and 8074 internal.
+
+## Outbound proxy configuration
+
+If your deployment requires using an outbound proxy, you can configure Mattermost using environment variables:
+
+1.  Configure the proxy settings in your service configuration:
+
+    ``` text
+    Environment=HTTP_PROXY=http://proxy.example.com:3128
+    Environment=HTTPS_PROXY=https://proxy.example.com:3128
+    Environment=NO_PROXY=localhost,127.0.0.1,.internal.example.com
+    ```
+
+    These lines go in the `[Service]` section of the `mattermost.service` systemd unit. See your install method's page for the complete unit file: [Ubuntu/Debian](/deployment-guide/server/linux/deploy-ubuntu), [RHEL](/deployment-guide/server/linux/deploy-rhel), or [manual tarball](/deployment-guide/server/linux/deploy-tar).
+
+2.  For authenticated proxies, include credentials in the URL:
+
+    ``` text
+    Environment=HTTP_PROXY=http://username:password@proxy.example.com:3128
+    Environment=HTTPS_PROXY=https://username:password@proxy.example.com:3128
+    ```
+
+    Anyone who can read the unit file can read these credentials. Restrict the file's permissions, or supply the values through a separate `EnvironmentFile` that only root can read.
+
+3.  The `NO_PROXY` variable can include:
+
+    - IP addresses (e.g., `1.2.3.4`)
+    - CIDR ranges (e.g., `1.2.3.4/8`)
+    - Domain names (e.g., `example.com`)
+    - Subdomains (e.g., `.example.com`)
+
+<Note>
+
+When using an HTTPS proxy, ensure your Mattermost server has the proxy's root certificate configured to avoid connection issues.
+
+</Note>
+
+## Next steps
+
+- [Set up an NGINX proxy](/deployment-guide/server/setup-nginx-proxy) and [set up TLS](/deployment-guide/server/setup-tls) so users connect over HTTPS.
+- Return to the [preparation checklist](/deployment-guide/server/preparations).