Network and Firewall¶
Applies to: All subscriptions
Purpose¶
Enumerate every network path Complifly needs, in both directions, in a form a network team can act on directly. Each rule names the symptom you will see if it is missing, so a blocked path can be diagnosed from behaviour rather than by inspection.
Audience¶
Network engineers, infrastructure engineers, security reviewers.
Prerequisites¶
- A chosen deployment topology
- The GSP selected, since its endpoints are provider-specific
- Whether an egress proxy is in use, and whether it intercepts TLS
Reference¶
Inbound¶
| # | Source | Destination | Port | Protocol | Required | Symptom if missing |
|---|---|---|---|---|---|---|
| N1 | User browsers | Reverse proxy | 443 | HTTPS | Always | Nobody can reach the application |
| N2 | Browsers on port 80 | Reverse proxy | 80 | HTTP | Optional | No automatic redirect to HTTPS |
| N3 | ERP systems | Reverse proxy | 443 | HTTPS | When the ERP pushes documents | Ingest calls fail at the network layer; the ERP sees a timeout, not a rejection |
| N4 | Monitoring platform | Reverse proxy or API | 443 | HTTPS | When health is probed externally | No external health visibility |
Nothing needs to be inbound-reachable from the public internet except the reverse proxy. The API, worker, database and queue must not be.
Internal¶
| # | Source | Destination | Port | Protocol | Required | Symptom if missing |
|---|---|---|---|---|---|---|
| N5 | Reverse proxy | API | Application port, 5003 by default | HTTP or HTTPS | Always | HTTP 502 from the proxy |
| N6 | API | Database | 1433 by default | TDS, encrypted | Always | API refuses to start |
| N7 | Worker | Database | 1433 by default | TDS, encrypted | Always | Background jobs never run |
| N8 | API and worker | Redis | 6379 by default | Redis | When queue-backed jobs are enabled | Jobs are enqueued and never consumed. No error appears in the interface |
Rule N8 is the one worth calling out to a network team explicitly. Blocking it does not produce an error — it produces an application that looks completely healthy while uploads silently never complete.
Outbound¶
| # | Source | Destination | Port | Protocol | Required | Symptom if missing |
|---|---|---|---|---|---|---|
| N9 | API and worker | GSP API endpoints | 443 | HTTPS | Always | Every government operation fails; local screens keep working |
| N10 | API | Microsoft identity endpoints | 443 | HTTPS | When machine-to-machine OAuth is used | ERP authentication fails with a token validation error |
| N11 | API and worker | Mail transport (SMTP or vendor HTTPS API) | 587, 465 or 443 | SMTP or HTTPS | Always in practice | No notifications, no password reset, no one-time codes. Users are locked out and nobody knows why |
| N12 | Worker | Customer ERP write-back endpoint | Customer-defined | HTTPS | When write-back pushes to the ERP | Write-back events retry, then dead-letter |
| N13 | Hosts | Operating system and package updates | 443 | HTTPS | For maintenance | Patching and dependency installation fail |
The GSP endpoints in N9 are provider-specific and are supplied by the provider. Register them as hostnames rather than addresses where your policy allows, because providers change addresses without notice.
Egress address restrictions¶
Some GSPs restrict access by source address. Where that applies:
| Requirement | Why |
|---|---|
| The egress address must be fixed | A changing address breaks every government call without warning |
| It must be registered with the provider | On the provider's side, not only in your own documentation |
| Failover paths must also be registered | A failover to a different egress address is an outage if only the primary is registered |
| Address changes must be treated as change-controlled | This is the most common cause of a sudden total failure of government operations |
Egress proxies¶
Where outbound traffic passes through a proxy:
| Requirement | Consequence if missed |
|---|---|
| Proxy configuration available to the application process | Outbound calls fail even though the host itself can reach the internet |
| The proxy's certificate authority trusted by the application | TLS handshake failures that look like provider outages |
| The proxy does not strip required headers | Authentication failures at the provider |
| Timeouts allow for the provider's slowest response | Spurious timeouts under load |
A TLS-intercepting proxy whose certificate is untrusted is one of the hardest failures to diagnose here, because the provider appears to be down while the network team can demonstrate that the host has internet access.
DNS and certificates¶
| Requirement | Notes |
|---|---|
| A resolvable hostname per published surface | Application, API, help and downloads may be distinct hostnames. See Domains and URLs |
| A valid certificate per hostname | Trusted by browsers and by any ERP that calls in |
| Download surface reachable from user browsers | Downloads are served from a different origin by design; if it is blocked, users see broken links rather than an error |
| Internal DNS resolves the database and queue hosts | From the application host specifically |
Validation¶
Test every rule from the host that will actually use it. A workstation frequently has access the server does not, and testing from the wrong place is the single most common reason a firewall problem survives into go-live.
| Rule | Test | Expected |
|---|---|---|
| N1 | Open the application in a browser | Sign-in page loads over HTTPS with a valid certificate |
| N3 | From the ERP host, call the ingest endpoint | An HTTP response of any kind. A timeout means the path is blocked; a 401 means the path works and only the credential is wrong |
| N5 | From the proxy host, request the API health endpoint | HTTP 200 |
| N6, N7 | From the application host, connect to the database with the application's own credentials | Connection succeeds with encryption enabled |
| N8 | From the application host, connect to Redis | Authenticated connection succeeds |
| N9 | Run the provider connection test from the admin console | Success. Do this before go-live, not on the day |
| N10 | Acquire a machine token and call an ingest endpoint | Accepted |
| N11 | Trigger a password-reset message | Delivered to a real mailbox |
| N12 | Trigger a write-back event | Reaches the ERP endpoint |
| Egress address | Confirm the address seen by the provider | Matches the registered address |
| Proxy trust | Make an outbound HTTPS call from the application process | No certificate validation error |
Troubleshooting¶
| Symptom | Likely rule | Action |
|---|---|---|
| HTTP 502 from the proxy | N5 | The proxy cannot reach the API. Check the API is listening and the port matches |
| Everything works except government operations | N9 | Provider unreachable, blocked, or the egress address is not allow-listed |
| Government operations fail intermittently | N9 with a failover egress path | An unregistered failover address. Register every path |
| ERP authentication fails with a token error | N10 | Identity endpoints unreachable; signing keys cannot be fetched |
| Users cannot reset passwords and never receive codes | N11 | Mail path blocked. This locks users out with no visible cause |
| Uploads queue forever, no errors anywhere | N8 | Queue unreachable. The interface gives no indication |
| Write-back events retry then dead-letter | N12 | ERP endpoint unreachable or refusing. See Write-back Failures |
| Provider appears down but the host has internet access | Proxy TLS interception | Trust the proxy's certificate authority in the application's trust store |
| Downloads produce broken links | Download origin blocked by proxy or content-security policy | Allow the download domain in both |
| Everything worked yesterday, all government calls fail today | Egress address changed | Check the source address the provider now sees. This is the most common cause of a sudden total failure |
Related Articles¶
- System Architecture — the components these paths connect
- Domains and URLs — the hostnames requiring certificates
- GSP Configuration — provider endpoints and connection testing
- Reverse Proxy and TLS — configuring the entry point
- Health Endpoints — probing these paths continuously