Configuration of minimum rules for Jira Server to work, navigation rules for incoming and outgoing t

[Diego Cañete]

Hi Team,

I am having some problems since the people of the IT Security Team limit the outgoing traffic from the server where I have Jira installed to outgoing and incoming internet, and I need to know what are the minimum rules that you should request from the security team so that Jira can leave and enter if it is what you need to the internet, this includes the urls or sites or domains that should check the plug-ins added.
If you could help me.

Thank you.

Diego Cañete.

[Joe Pitt]

All traffic from the user goes through the html ports: 80/8080 or 443 if you're using encryption. If you have a typical setup the JIRA server communicates to the database on whatever port the database uses.  If you have a typical setup the JIRA server sits in the DMZ and the html port is open for user access. The database sits inside the local network so you need the port JIRA uses to talk to the database open. All you should have to do for the network folks is tell them what ports are in use and have them set the firewall rules. Usually the network folks are the ones you get the port assignments from. Some companies don't use the standard ports as an extra measure of security. The URL for the internet needs to have an entry in the company DNS that converts it to an IP address for the JIRA server. You shouldn't have been able to get JIRA working without the network folks telling you all the ports and IP addresses you need unless you installed the database on the same server as JIRA and accessing it from the server as 'localhost' 

Plugins have no impact on this. The are part of the JIRA server 

[Diego Cañete]

Hi Joe_Pitt,
Thanks for answering, I mean the traffic of Jira's service to the Internet not to the internal network, for now the local users have no problems, what I see is that some plug-ins are stop working correctly.
And I understand that we must allow navigation to some domains type atlassian.com and surely the pugligs also have to go online.

[Joe Pitt]

All the traffic to the outside users goes through the html ports (80/8080 or 443). I've never needed to open any outside port except the html ones. If you're having a problem getting to Atlassian.com it needs to be added to the whitelist. I only use a couple of the main (paid for) plugins and never have them stop working.  The plugins are part of JIRA code once installed so they should only communicate through the JIRA html ports. I would contact the plugin support about them not working. If they need to communicate to a specific domain it should be in the install guide. 

[Diego Cañete]

[Diego Cañete]

Comperndo, check this outbound traffic from our server to a server in China over UDP / 53. This is normal?