Skip to main content

Network ports and outbound proxy

Open the ports Mattermost needs before you install, and note the outbound destinations your deployment will reach. If your environment blocks direct outbound access, configure an outbound proxy at the same time.

Network ports​

The following table outlines the network ports and protocols required for Mattermost server:

Service NameConfig SettingPort (default)ProtocolDirectionInfo
HTTP/WebsocketServiceSettings.ListenAddress8065/80/443 (TLS)TCPInboundExternal (no proxy) / Internal (with proxy) Usually this requires port 80 and 443 when running HTTPS.
ClusterClusterSettings.GossipPort8074TCP/UDPInboundInternal
MetricsMetricsSettings.ListenAddress8067TCPInboundExternal (no proxy) / Internal (with proxy)
DatabaseSqlSettings.DataSource5432 (PostgreSQL) / 3306 (MySQL)TCPOutboundUsually internal (recommended)
LDAPLdapSettings.LdapPort389TCP/UDPOutbound
S3 StorageFileSettings.AmazonS3Endpoint443 (TLS)TCPOutbound
SMTPEmailSettings.SMTPPort10025TCP/UDPOutbound
Push NotificationsEmailSettings.PushNotificationServer443 (TLS)TCPOutbound

Only the inbound ports your readers actually reach need to be exposed externally. When Mattermost runs behind an NGINX reverse proxy, expose 80 and 443 at the proxy and keep 8065, 8067, and 8074 internal.

Outbound proxy configuration​

If your deployment requires using an outbound proxy, you can configure Mattermost using environment variables:

  1. Configure the proxy settings in your service configuration:

    Environment=HTTP_PROXY=http://proxy.example.com:3128
    Environment=HTTPS_PROXY=https://proxy.example.com:3128
    Environment=NO_PROXY=localhost,127.0.0.1,.internal.example.com

    These lines go in the [Service] section of the mattermost.service systemd unit. See your install method's page for the complete unit file: Ubuntu/Debian, RHEL, or manual tarball.

  2. For authenticated proxies, include credentials in the URL:

    Environment=HTTP_PROXY=http://username:password@proxy.example.com:3128
    Environment=HTTPS_PROXY=https://username:password@proxy.example.com:3128

    Anyone who can read the unit file can read these credentials. Restrict the file's permissions, or supply the values through a separate EnvironmentFile that only root can read.

  3. The NO_PROXY variable can include:

    • IP addresses (e.g., 1.2.3.4)
    • CIDR ranges (e.g., 1.2.3.4/8)
    • Domain names (e.g., example.com)
    • Subdomains (e.g., .example.com)

Next steps​