ProPay Ports for AWS Security Groups

Overview

When you set up AWS security groups for ProPay, you should allow only the specific network ports that ProPay needs instead of opening all traffic. This article lists the ports ProPay uses and shows how to configure your VPC security groups with the principle of least privilege — allowing only the traffic your setup requires.

Why Specific Ports Matter

The Step 5: Create Security Groups guide uses "ALL Traffic" rules for VPC-internal and LAN communication. While this works, it allows more access than necessary. Restricting traffic to specific ports reduces your attack surface and follows AWS security best practices.

Ports ProPay Requires

Port	Protocol	Service	Purpose	Required?
445	TCP	SMB/CIFS	File sharing — ProPay stores data in shared folders accessed by all workstations over SMB.	Yes
3389	TCP	RDP	Remote Desktop — Administer the Windows Server running ProPay.	Yes
80	TCP	HTTP	ProPay WEB — Serves web pages to clients through IIS (if ProPay WEB is installed).	Only if using ProPay WEB
443	TCP	HTTPS	Secure web traffic — Required if you install an SSL certificate for ProPay WEB.	Only if using SSL with ProPay WEB
25 or 587	TCP	SMTP	Email — ProPay can send payroll reports and notifications by email. Port 25 is standard SMTP; port 587 is the submission port used by most email providers.	Only if using ProPay email features
ICMP	ICMP	Ping	Network diagnostics — Used for testing connectivity between your office and AWS.	Recommended

Recommended Security Group Configuration

Replace the "ALL Traffic" rules in your Private-Server security group with specific port rules.

Private-Server inbound rules (recommended)

Type	Protocol	Port Range	Source	Purpose
Custom TCP	TCP	445	10.0.0.0/16	SMB file sharing within VPC
Custom TCP	TCP	445	192.168.1.0/24	SMB file sharing from office LAN
RDP	TCP	3389	192.168.1.0/24	Remote Desktop from office LAN
Custom ICMP	ICMP	All	10.0.0.0/16	Ping within VPC
Custom ICMP	ICMP	All	192.168.1.0/24	Ping from office LAN

Add these rules only if you use the corresponding features:

Type	Protocol	Port Range	Source	Purpose
HTTP	TCP	80	0.0.0.0/0	ProPay WEB (if installed)
HTTPS	TCP	443	0.0.0.0/0	ProPay WEB with SSL (if installed)
Custom TCP	TCP	587	10.0.0.0/16	Outbound email relay (if using ProPay email)

> Note: Replace `192.168.1.0/24` with your actual office LAN subnet. See Step 5: Create Security Groups for instructions on finding your subnet.

Public-Server inbound rules

The Public-Server security group rules from Step 5 are already specific. No changes are needed for HTTP (80), HTTPS (443), or RDP (3389). Replace only the "ALL Traffic" rules with the port-specific rules listed above.

Outbound rules

ProPay requires outbound access for:

Port	Protocol	Purpose
443	TCP	Software updates and license activation
25 or 587	TCP	Sending email (if configured)
53	TCP/UDP	DNS resolution (only if using custom DNS servers outside the VPC — AWS provides DNS resolution by default)

> Tip: AWS security groups are stateful. If you allow inbound traffic on a port, the return traffic is automatically allowed. You do not need to create separate outbound rules for responses.

Tips and Warnings

> Tip: Start with the "ALL Traffic" rules from Step 5 to confirm everything works, then tighten the rules to specific ports once your setup is verified.

> Warning: If you restrict ports and ProPay cannot access shared files, the most likely cause is that SMB (port 445) is blocked. Verify this port is open between all instances that need to share ProPay data files.

> Note: ProPay does not use a SQL database. All data is stored in database files accessed through SMB file sharing.