VPS Firewall

EmitMail's production Docker Compose file maps host TCP port 25 to the API container's inbound SMTP listener on port 2525. You do not need an extra iptables redirect when using Compose. The dashboard, API, and docs web ports bind to localhost by default and should be reached through a reverse proxy or SSH tunnel.

Allow required portsCopy Anchor Link

For a typical public deployment, allow SSH, web traffic, and inbound SMTP. Compose also maps host port 2525 to the same inbound SMTP listener; only allow it if you specifically need that alternate listener port.

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 25/tcp
# Optional alternate port for the inbound SMTP listener
sudo ufw allow 2525/tcp
sudo ufw enable

Apply equivalent rules in your provider's network firewall or security group. Do not expose the API, dashboard, docs, database, or Redis ports directly to the internet. Outbound TCP 25 is needed for direct-to-recipient delivery and may have separate provider restrictions.

Test inbound SMTPCopy Anchor Link

After starting the production Compose stack, test the host's SMTP listener:

telnet localhost 25

A successful connection displays an SMTP 220 greeting. Type QUIT to close the connection. If it fails, check that the API container is healthy, host TCP 25 is not already in use, and both the host firewall and provider firewall permit inbound TCP 25.