Firewall Rules

Network Security (only trusted proxies may access the VM): UMP-365 trusts forwarded headers received on port 80. Therefore, access to port 80 must be restricted to the WAF and, where applicable, the internal proxy used by Live Platform. Allowing other sources to connect directly to the VM could enable header spoofing, resulting in incorrect protocol detection or client IP information. Configure the VM's NSG and Windows Firewall to permit port 80 access only from these trusted sources and deny all other inbound connections.

Direction	Port	Source	Action
Inbound	TCP 80	Application Gateway subnet	Allow
Inbound	TCP 80	Internal proxy for OVOC and LiveHub SSO, if used	Allow
Inbound	65200 to 65535 on the gateway subnet	GatewayManager service tag	Allow (on the NSG of the gateway subnet; Azure needs it to manage Application Gateway v2)
Inbound	TCP 3389 (RDP)	Azure Bastion subnet or admin VPN only	Allow
Inbound	Everything else	Any	Deny

The following ports must not be reachable from the internet or from the wider network.

Port	Component	Note
TCP 443	IIS with the self-signed certificate	See IIS bindings above
TCP 1433 or the dynamic port of the instance, UDP 1434	SQL Server instance SQLSYSADMIN and SQL Browser	Only needed from other servers if tenant databases are remote
TCP 5672	RabbitMQ message bus	The UMP services connect on localhost
TCP 15672	RabbitMQ management web page
TCP 4369, TCP 25672	Erlang port mapper and RabbitMQ clustering	Not used: UMP runs a single RabbitMQ node
TCP 5985, 5986	WinRM (PowerShell remoting)	Admin network only, if used at all