Skip to content

Network ports and outbound proxy

Open the ports Mattermost needs before you install, and note the outbound destinations your deployment will reach. If your environment blocks direct outbound access, configure an outbound proxy at the same time.

Network ports

The following table outlines the network ports and protocols required for Mattermost server:

Service Name Config Setting Port (default) Protocol Direction Info
HTTP/Websocket ServiceSettings.ListenAddress 8065/80/443 (TLS) TCP Inbound External (no proxy) / Internal (with proxy) Usually this requires port 80 and 443 when running HTTPS.
Cluster ClusterSettings.GossipPort 8074 TCP/UDP Inbound Internal
Metrics MetricsSettings.ListenAddress 8067 TCP Inbound External (no proxy) / Internal (with proxy)
Database SqlSettings.DataSource 5432 (PostgreSQL) / 3306 (MySQL) TCP Outbound Usually internal (recommended)
LDAP LdapSettings.LdapPort 389 TCP/UDP Outbound
S3 Storage FileSettings.AmazonS3Endpoint 443 (TLS) TCP Outbound
SMTP EmailSettings.SMTPPort 10025 TCP/UDP Outbound
Push Notifications EmailSettings.PushNotificationServer 443 (TLS) TCP Outbound

  • All outbound ports may vary based on your specific configuration
  • Mattermost can be configured to use an outbound proxy for any HTTP/HTTPS traffic (see below)
  • Calls service may require additional ports. See the Calls deployment guide for details.

Only the inbound ports your readers actually reach need to be exposed externally. When Mattermost runs behind an NGINX reverse proxy, expose 80 and 443 at the proxy and keep 8065, 8067, and 8074 internal.

Outbound proxy configuration

If your deployment requires using an outbound proxy, you can configure Mattermost using environment variables:

  1. Configure the proxy settings in your service configuration:

    Environment=HTTP_PROXY=http://proxy.example.com:3128
Environment=HTTPS_PROXY=https://proxy.example.com:3128
Environment=NO_PROXY=localhost,127.0.0.1,.internal.example.com

    These lines go in the [Service] section of the mattermost.service systemd unit. See your install method's page for the complete unit file: Ubuntu/Debian, RHEL, or manual tarball.

  2. For authenticated proxies, include credentials in the URL:

    Environment=HTTP_PROXY=http://username:password@proxy.example.com:3128
Environment=HTTPS_PROXY=https://username:password@proxy.example.com:3128

    Anyone who can read the unit file can read these credentials. Restrict the file's permissions, or supply the values through a separate EnvironmentFile that only root can read.

  3. The NO_PROXY variable can include:

    • IP addresses (e.g., 1.2.3.4)
    • CIDR ranges (e.g., 1.2.3.4/8)
    • Domain names (e.g., example.com)
    • Subdomains (e.g., .example.com)

When using an HTTPS proxy, ensure your Mattermost server has the proxy's root certificate configured to avoid connection issues.

Next steps