---
title: "Blocked ports and internet resources"
sidebar_label: "Blocked ports and internet resources"
description: "Information about blocked TCP and UDP ports, as well as internet resources"
sidebar_position: 7
author: false
---

import { CustomTable } from '@selectel/docux/components';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import {TabItemLabel} from '@selectel/docux/components';
import Formbricks from '@theme/MDXComponents/Formbricks';

# Blocked ports and internet resources

In the Selectel infrastructure, a number of TCP/UDP ports are blocked; details and a list of such ports can be found in the [Blocked Ports](#blocked-ports) subsection.

Also, access to public subnets of the e-government is blocked from the Selectel infrastructure. For example, the Gosuslugi portal and related services are located in such a subnet.

A full list of internet resources related to the e-government can be found in the [What is e-government](https://www.gosuslugi.ru/help/faq/legal_issues/2683) guide in the Gosuslugi portal documentation.

You can [submit a request for unblocking](#submit-request-to-unblock). Each request is reviewed individually, but we cannot guarantee that access will be unblocked.

## Blocked ports \{#blocked-ports}

To secure your Selectel infrastructure from malicious network activity, we limit access to certain TCP/UDP ports. Both incoming and outgoing traffic is blocked when passing through border routers (edge routers) at the border of the Selectel network.

For TCP ports 25, 465, 587, only outgoing traffic to public IPv4 and IPv6 addresses is blocked. Instead of these ports, we recommend using the [Selectel email service](/email-service/about/about-email-service.mdx).

The full list of blocked ports is specified in the [List of blocked ports](#blocked-ports-list) table. If a port is unavailable but is not listed in the table, check its accessibility from the operating system using the `nmap`.

### List of blocked ports \{#blocked-ports-list}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Port and application protocol</th><th>Port purpose</th><th>Transport protocol</th><th>Reason for blocking</th><th>Requesting unblocking is possible</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <td>
          17 <small>QOTD</small>
        </td>

        <td>Transmission of a short text message when a client connects to a server</td><td>TCP/UDP</td>

        <td>
          * low security level;
          * risk of amplification attacks
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          25 <small>SMTP</small>
        </td>

        <td>Sending emails between servers in plaintext</td><td>TCP</td>

        <td>
          * spam prevention;
          * risk of interception of unencrypted traffic
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          111 <small>ONC RPC (SunRPC)</small>
        </td>

        <td>Mapping RPC services (nfs, mountd, etc.) to port numbers on the server</td><td>TCP/UDP</td>

        <td>
          * risk of discovering all RPC services;
          * risk of unauthorized file access
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          135 <small>Microsoft EPMAP</small>
        </td>

        <td>Mapping RPC calls to specific services and ports on a remote system</td><td>TCP/UDP</td>

        <td>
          * risk of unauthorized system access;
          * risk of interception and manipulation of RPC calls (MITM);
          * risk of service or method enumeration
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          137 <small>NetBIOS Name Service</small>
        </td>

        <td>Resolving computer names in a local network using the NetBIOS protocol</td><td>TCP/UDP</td>

        <td>
          * risk of network reconnaissance;
          * risk of unauthorized access to resources;
          * device name spoofing in the network;
          * risk of DoS attacks through broadcast traffic overload
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          138 <small>NetBIOS Datagram Service</small>
        </td>

        <td>Transferring small messages between devices in a network without establishing a connection</td><td>TCP/UDP</td>

        <td>
          * risk of attacks via unencrypted data transmission;
          * risk of DoS attacks through broadcast traffic overload;
          * risk of gathering information about hosts, users, and shared resources
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          139 <small>NetBIOS Session Service</small>
        </td>

        <td>Shared access to files, printers, and ports in Windows networks via NetBIOS</td><td>TCP/UDP</td>

        <td>
          * risk of attacks on SMB and NetBIOS vulnerabilities;
          * risk of network scanning and information gathering
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          389 <small>LDAP</small>
        </td>

        <td>Connecting to an LDAP directory for authentication and data search</td><td>TCP/UDP</td>

        <td>
          * risk of password brute-forcing;
          * risk of unauthorized access to directory data
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          427 <small>SLP</small>
        </td>

        <td>Discovering network services and devices in a local network</td><td>TCP/UDP</td>

        <td>
          * risk of amplification attacks;
          * risk of internal network structure exposure
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          445 <small>SMB</small>
        </td>

        <td>File sharing in Windows networks via TCP/IP without NetBIOS</td><td>TCP/UDP</td>

        <td>
          * risk of attacks on SMB vulnerabilities;
          * risk of password brute-forcing;
          * risk of malware propagation
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          465 <small>SMTPS</small>
        </td>

        <td>Secure email sending (SMTPS) using SSL/TLS encryption</td><td>TCP</td>

        <td>
          * risk of downgrade attacks;
          * risk of hiding malicious traffic from analysis
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          520 <small>RIP</small>
        </td>

        <td>Exchanging routing information in small networks using the RIP protocol</td><td>UDP</td>

        <td>
          * risk of traffic redirection for data interception (route spoofing);
          * risk of traffic redirection to a malicious node (MITM);
          * risk of DoS attacks via malicious updates
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          587 <small>SMTP</small>
        </td>

        <td>Secure email sending via SMTP using STARTTLS</td><td>TCP</td>

        <td>
          * risk of spam and phishing due to weak security;
          * risk of password brute-forcing;
          * risk of data leakage with disabled or weak encryption
        </td>

        <td>✓</td>
      </tr>

      <tr>
        <td>
          1900 <small>SSDP</small>
        </td>

        <td>Device and service discovery in a local network (printers, TVs, routers)</td><td>UDP</td>

        <td>
          * risk of DoS attacks through request overload;
          * risk of automatic port opening on a router
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          3702 <small>WS-Discovery</small>
        </td>

        <td>Dynamic web service discovery in a local network</td><td>UDP</td>

        <td>
          * risk of amplification attacks;
          * risk of unauthorized access to devices
        </td>

        <td>✗</td>
      </tr>

      <tr>
        <td>
          11211 <small>Memcached</small>
        </td>

        <td>Access to Memcached cache server for accelerating web applications</td><td>TCP/UDP</td>

        <td>
          * risk of amplification attacks;
          * risk of data leakage in the absence of authentication
        </td>

        <td>✗</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Submit a request for unblocking \{#submit-request-to-unblock}

You can submit a request for unblocking:

* [access to e-government subnets](#e-government-subnet-access);

* [mail ports 25, 465, 587](#port-25-465-587);

* [ports 135, 137, 138, 139, 445](#ports-135-137-138-139-445).

Each request is reviewed individually, but we cannot guarantee that access will be unblocked and reserve the right to refuse without explanation.

After unblocking, a port  or subnet access may be blocked again, for example, if you send spam or your IP address is blacklisted. For more information, see the [Network Blocks](/network-incidents/blocked-traffic.mdx) guide.

### Access to e-government subnets \{#e-government-subnet-access}

You cannot unblock access to e-government subnets for [VDS servers](/vds-servers/).

Each unblocking request is reviewed individually, but we cannot guarantee that the port will be unblocked and reserve the right to decline requests without providing a reason.

<Tabs queryString="#ports-135-137-138-139-445">
  <TabItem value="dedicated" default>
    <TabItemLabel>
      Dedicated Servers
    </TabItemLabel>

    1. [Create a ticket](https://my.selectel.ru/tickets). In the ticket, specify:

       * the purpose of access;

       * IP addresses or subnets from which traffic will originate.

    2. Wait for a response from a Selectel employee in the ticket regarding the decision.
  </TabItem>

  <TabItem value="cloud">
    <TabItemLabel>
      Cloud servers
    </TabItemLabel>

    You can submit an unblocking request only for a [public subnet of a cloud server](/cloud-servers/cloud-networks/public-subnets.mdx).

    1. Make sure the server IP address belongs to a public subnet. In the [control panel](https://my.selectel.ru/vpc/default/networks-external) in the top menu click **Products** → **Cloud servers** → **Network** section → **Public subnets** tab → view the list of networks. If the IP address does not belong to a public subnet, you cannot unblock the port for it.

    2. [Create a ticket](https://my.selectel.ru/tickets). In the ticket, specify:

       * the purpose of access;

       * IP addresses or subnets from which traffic will originate.

    3. Wait for a response from a Selectel employee in the ticket regarding the decision.
  </TabItem>
</Tabs>

### Ports 25, 465, 587 \{#port-25-465-587}

Each unblocking request is reviewed individually, but we cannot guarantee that the port will be unblocked and reserve the right to decline requests without providing a reason. Instead of ports 25, 465, and 587, we recommend using our [Selectel email service](/email-service/about/about-email-service.mdx).

If we approve your request, ports 25, 465, and 587 will be unblocked for all public addresses in the account, except for:

* IP addresses of dedicated servers in [pools](/infrastructure/locations.mdx#pool) TAS-1, TAS-2, ALM-1, NBO-1;
* IP addresses of the cloud platform in [pools](/infrastructure/locations.mdx#pool) uz-1, uz-2, kz-1, ke-1, as well as [direct public IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) in all pools;
* IP addresses of [VDS servers](/vds-servers/).

To request unblocking of email ports:

1. [Create a ticket](https://my.selectel.ru/tickets). In the ticket, specify:

   * types of emails — for example, transactional, business correspondence, newsletters, etc.;
   * examples of emails;
   * planned subjects (email topics);
   * the domain from which the emails will be sent;
   * expected sending volume — number of emails per week.

2. Wait for a response from a Selectel employee in the ticket regarding the decision.

### Ports 135, 137, 138, 139, 445 \{#ports-135-137-138-139-445}

It is not possible to unblock ports 135, 137, 138, 139, 445 for [VDS servers](/vds-servers/).

You can only unblock ports 135, 137, 138, 139, 445 for servers located in Russia. For servers in other [countries](/infrastructure/locations.mdx#country), this is not possible.

We review every unblocking request on a case-by-case basis, but we cannot guarantee that ports will be unblocked and reserve the right to refuse without providing reasons.

<Tabs queryString="#ports-135-137-138-139-445">
  <TabItem value="dedicated" default>
    <TabItemLabel>
      Dedicated Servers
    </TabItemLabel>

    You can only submit a request to unblock a port for a [public dedicated subnet of a dedicated server](/dedicated/networks/public-networks-and-subnets.mdx#public-dedicated-ips).

    1. Make sure that the server's IP address belongs to a public dedicated subnet. In the [control panel](https://my.selectel.ru/vpc/default/networks-external), in the top menu, click **Products** → **Dedicated Servers** → **Network** → **Public Subnets** tab → select the **Dedicated** subnet type → view the list of networks. If the IP address does not belong to a public dedicated subnet, you cannot unblock the port for it.

    2. [Create a ticket](https://my.selectel.ru/tickets/create). In the ticket, specify:

       * the port to be unblocked;
       * the purpose of using the port;
       * public dedicated subnet of the dedicated server for which the port needs to be unblocked. You can view the list of public dedicated subnets in the [control panel](https://my.selectel.ru/servers/network/subnets): in the top menu click **Products** → **Dedicated Servers** → **Network** → **Public Subnets** tab → select the subnet type **Dedicated**.

    3. Wait for a response from a Selectel employee in the ticket regarding the decision.
  </TabItem>

  <TabItem value="cloud">
    <TabItemLabel>
      Cloud servers
    </TabItemLabel>

    You can only submit a request to unblock a port for a [public subnet of a cloud server](/cloud-servers/cloud-networks/public-subnets.mdx).

    1. Make sure that the server's IP address belongs to a public subnet. In the [control panel](https://my.selectel.ru/vpc/default/networks-external), in the top menu, click **Products** → **Cloud servers** → the **Network** section → **Public Subnets** tab → view the list of networks. If the IP address does not belong to a public subnet, you cannot unblock the port for it.

    2. [Create a ticket](https://my.selectel.ru/tickets/create). In the ticket, specify:

       * the port to be unblocked;
       * the purpose of using the port;
       * the public subnet of the cloud server for which the port needs to be unblocked. You can view the list of public subnets in the [control panel](https://my.selectel.ru/vpc/default/networks-external): in the top menu, click **Products** → **Cloud servers** → the **Network** section → **Public Subnets**.

    3. Wait for a response from a Selectel employee in the ticket regarding the decision.
  </TabItem>
</Tabs>

<Formbricks />