🔌 port-allocation

Complete reference matrix of all TCP/UDP ports utilized by the Mulvox self-contained hosting ecosystem.

CRITICAL WARNING
Internal ports (4030, 4031, 4032, 4033) must NEVER be exposed directly to the public internet. They are designed for loopback binding or proxy mappings from the panel core only.

All Ecosystem Ports

Port Service Daemon Protocol Visibility Scope Description
80 onifast-aero TCP Public Plain HTTP traffic for all hosted domains (redirectable)
443 onifast-aero TCP Public TLS-terminated HTTPS traffic for all hosted domains
25 mulvox-mail TCP Public SMTP inbound delivery MTA + mail relay
53 mulvox-dns UDP+TCP Public Authoritative DNS query resolution handler
587 mulvox-mail TCP Public Authenticated SMTP client submission port
21 mulvox-ftp TCP Public FTP command control connection listener
4048 mulvox-panel TCP Public Root Admin Panel HTTP (non-SSL fallback login)
4049 mulvox-panel TCP Public Client/User Panel HTTP (non-SSL & SSL setup portal)
4050 mulvox-panel TCP Public Root Admin Panel HTTPS — primary administrative access hub
4051 mulvox-panel TCP Public Client/User Panel HTTPS — client user account access
4053 mulvox-gateway TCP Public Web Proxy Output (forwards public HTTP/HTTPS traffic to agents)
30000–30100 mulvox-ftp TCP Public FTP Passive data transfer range (required for file uploads/downloads)
1883 mulvox-iotflow TCP Public MQTT Broker Port — accepts unencrypted MQTT connections from sensors
4030 onifast-aero TCP Internal ACME SSL generation API (localhost HTTP-01 challenges only)
4031 mulvox-mail TCP Proxied Webmail UI + HTTP API (proxied via panel as /mail)
4032 mulvox-cloud TCP Proxied S3 API + Web UI (proxied via panel as /s3)
4034 mulvox-gateway TCP Proxied Unified Gateway WebSocket dial-in & WebRTC signaling (proxied to /dial/gateway and /webrtc/signaling)
4035 mulvox-iotflow TCP Internal Internal WebSocket Gateway (localhost only, proxied via onifast-aero)
4036 mulvox-iotflow TCP Internal Internal Management API (localhost only)
4037 mulvox-pgadmin TCP Proxied PostgreSQL Admin Web UI & API (proxied via panel as /postgres-browser/)
4038 mulvox-myadmin TCP Proxied MySQL / MariaDB Admin Web UI & API (proxied via panel as /mysql-browser/)

Ecosystem Access Mappings

Service Daemon Standard Dial URL / Command
Root Admin Panel https://your-domain:4050
Client/User Panel https://your-domain:4051
Root phpMyAdmin https://your-domain:4050/phpmyadmin
MySQL Browser (mulvox-myadmin) https://your-domain:4050/mysql-browser/ (proxied silently via panel)
PostgreSQL Browser (mulvox-pgadmin) https://your-domain:4050/postgres-browser/ (proxied silently via panel)
Local S3 Explorer https://your-domain:4050/s3 (proxied silently via panel)
Webmail Client https://your-domain:4050/mail (proxied silently via panel)
Hosted Websites http://your-domain / https://your-domain
FTP Service ftp://your-domain (port 21, requires passive range enabled)
Authoritative DNS dig @your-domain example.com
Gateway Dial-In status https://your-domain/dial/gateway/status

UFW Firewall Rules

bash 
# Panel ports
sudo ufw allow 4048:4051/tcp

# Web ports
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Mail ports
sudo ufw allow 25/tcp
sudo ufw allow 587/tcp

# FTP control + passive data ranges
sudo ufw allow 21/tcp
sudo ufw allow 30000:30100/tcp

# Authoritative DNS query channels
sudo ufw allow 53/tcp
sudo ufw allow 53/udp

# Relay tunnel gateway ports
sudo ufw allow 4053/tcp
 
# IoT Stream MQTT Port
sudo ufw allow 1883/tcp
 
# Reload firewall
sudo ufw reload

iptables Firewall Rules

bash 
# Panel
iptables -A INPUT -p tcp --dport 4048:4051 -j ACCEPT

# Web
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Mail
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 587 -j ACCEPT

# FTP
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 30000:30100 -j ACCEPT

# DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

# Relay
iptables -A INPUT -p tcp --dport 4053 -j ACCEPT
 
# IoT Stream MQTT Port
iptables -A INPUT -p tcp --dport 1883 -j ACCEPT

Checking Port Listeners

Use lsof to verify which services are active on specific ports:

bash 
# Check active panel listener
sudo lsof -i :4050

# Check web server sockets
sudo lsof -i :80
sudo lsof -i :443

# Check FTP controller
sudo lsof -i :21

# Check authoritative DNS
sudo lsof -i :53

# Check Relay gateway
sudo lsof -i :4034
 
# Check IoT Stream MQTT Broker
sudo lsof -i :1883

Health Checks & Diagnostic curls

Test that active loops are responding to local queries:

bash 
# Check panel response
curl -k https://localhost:4050

# Check web server response
curl -I http://localhost:80

# Check FTP handshake
telnet localhost 21

# Check DNS resolution
dig @localhost example.com