Skip to content

Network and Firewall

Applies to: All subscriptions

Purpose

Enumerate every network path Complifly needs, in both directions, in a form a network team can act on directly. Each rule names the symptom you will see if it is missing, so a blocked path can be diagnosed from behaviour rather than by inspection.

Audience

Network engineers, infrastructure engineers, security reviewers.

Prerequisites

  • A chosen deployment topology
  • The GSP selected, since its endpoints are provider-specific
  • Whether an egress proxy is in use, and whether it intercepts TLS

Reference

Inbound

# Source Destination Port Protocol Required Symptom if missing
N1 User browsers Reverse proxy 443 HTTPS Always Nobody can reach the application
N2 Browsers on port 80 Reverse proxy 80 HTTP Optional No automatic redirect to HTTPS
N3 ERP systems Reverse proxy 443 HTTPS When the ERP pushes documents Ingest calls fail at the network layer; the ERP sees a timeout, not a rejection
N4 Monitoring platform Reverse proxy or API 443 HTTPS When health is probed externally No external health visibility

Nothing needs to be inbound-reachable from the public internet except the reverse proxy. The API, worker, database and queue must not be.

Internal

# Source Destination Port Protocol Required Symptom if missing
N5 Reverse proxy API Application port, 5003 by default HTTP or HTTPS Always HTTP 502 from the proxy
N6 API Database 1433 by default TDS, encrypted Always API refuses to start
N7 Worker Database 1433 by default TDS, encrypted Always Background jobs never run
N8 API and worker Redis 6379 by default Redis When queue-backed jobs are enabled Jobs are enqueued and never consumed. No error appears in the interface

Rule N8 is the one worth calling out to a network team explicitly. Blocking it does not produce an error — it produces an application that looks completely healthy while uploads silently never complete.

Outbound

# Source Destination Port Protocol Required Symptom if missing
N9 API and worker GSP API endpoints 443 HTTPS Always Every government operation fails; local screens keep working
N10 API Microsoft identity endpoints 443 HTTPS When machine-to-machine OAuth is used ERP authentication fails with a token validation error
N11 API and worker Mail transport (SMTP or vendor HTTPS API) 587, 465 or 443 SMTP or HTTPS Always in practice No notifications, no password reset, no one-time codes. Users are locked out and nobody knows why
N12 Worker Customer ERP write-back endpoint Customer-defined HTTPS When write-back pushes to the ERP Write-back events retry, then dead-letter
N13 Hosts Operating system and package updates 443 HTTPS For maintenance Patching and dependency installation fail

The GSP endpoints in N9 are provider-specific and are supplied by the provider. Register them as hostnames rather than addresses where your policy allows, because providers change addresses without notice.

Egress address restrictions

Some GSPs restrict access by source address. Where that applies:

Requirement Why
The egress address must be fixed A changing address breaks every government call without warning
It must be registered with the provider On the provider's side, not only in your own documentation
Failover paths must also be registered A failover to a different egress address is an outage if only the primary is registered
Address changes must be treated as change-controlled This is the most common cause of a sudden total failure of government operations

Egress proxies

Where outbound traffic passes through a proxy:

Requirement Consequence if missed
Proxy configuration available to the application process Outbound calls fail even though the host itself can reach the internet
The proxy's certificate authority trusted by the application TLS handshake failures that look like provider outages
The proxy does not strip required headers Authentication failures at the provider
Timeouts allow for the provider's slowest response Spurious timeouts under load

A TLS-intercepting proxy whose certificate is untrusted is one of the hardest failures to diagnose here, because the provider appears to be down while the network team can demonstrate that the host has internet access.

DNS and certificates

Requirement Notes
A resolvable hostname per published surface Application, API, help and downloads may be distinct hostnames. See Domains and URLs
A valid certificate per hostname Trusted by browsers and by any ERP that calls in
Download surface reachable from user browsers Downloads are served from a different origin by design; if it is blocked, users see broken links rather than an error
Internal DNS resolves the database and queue hosts From the application host specifically

Validation

Test every rule from the host that will actually use it. A workstation frequently has access the server does not, and testing from the wrong place is the single most common reason a firewall problem survives into go-live.

Rule Test Expected
N1 Open the application in a browser Sign-in page loads over HTTPS with a valid certificate
N3 From the ERP host, call the ingest endpoint An HTTP response of any kind. A timeout means the path is blocked; a 401 means the path works and only the credential is wrong
N5 From the proxy host, request the API health endpoint HTTP 200
N6, N7 From the application host, connect to the database with the application's own credentials Connection succeeds with encryption enabled
N8 From the application host, connect to Redis Authenticated connection succeeds
N9 Run the provider connection test from the admin console Success. Do this before go-live, not on the day
N10 Acquire a machine token and call an ingest endpoint Accepted
N11 Trigger a password-reset message Delivered to a real mailbox
N12 Trigger a write-back event Reaches the ERP endpoint
Egress address Confirm the address seen by the provider Matches the registered address
Proxy trust Make an outbound HTTPS call from the application process No certificate validation error

Troubleshooting

Symptom Likely rule Action
HTTP 502 from the proxy N5 The proxy cannot reach the API. Check the API is listening and the port matches
Everything works except government operations N9 Provider unreachable, blocked, or the egress address is not allow-listed
Government operations fail intermittently N9 with a failover egress path An unregistered failover address. Register every path
ERP authentication fails with a token error N10 Identity endpoints unreachable; signing keys cannot be fetched
Users cannot reset passwords and never receive codes N11 Mail path blocked. This locks users out with no visible cause
Uploads queue forever, no errors anywhere N8 Queue unreachable. The interface gives no indication
Write-back events retry then dead-letter N12 ERP endpoint unreachable or refusing. See Write-back Failures
Provider appears down but the host has internet access Proxy TLS interception Trust the proxy's certificate authority in the application's trust store
Downloads produce broken links Download origin blocked by proxy or content-security policy Allow the download domain in both
Everything worked yesterday, all government calls fail today Egress address changed Check the source address the provider now sees. This is the most common cause of a sudden total failure