Firewall and Network

This page is also in the Courier wiki: https://github.com/rsjsoftwareltd/courier/wiki/Firewall-and-Network

Courier is self-hosted: it runs on a Windows Server on your own network, and the RSJ Agents on your computers reach it there. Nothing needs to be reachable from the internet.

The quick version: allow inbound TCP 8445 to the Courier server, from the computers that should show notices. That is the only port Courier listens on. Everything else is outbound from the server, and only for updates and, if you set it up, your own Active Directory (see below).

What talks to what #

The RSJ Agent on each computer -> the Courier server, over HTTPS on TCP 8445. The agent checks in, waits for notices and sends receipts back. The server never opens a connection to a computer.
People -> the console. Use the console from any computer on your network: open https://<server name or address>:8445 and sign in. It is the same port the agents use, so the same firewall rule covers it. The first administrator account can only be created on the server itself (Courier -> Open Console in the Start menu there). To limit the console to certain computers, list their addresses under General Settings -> Access; the RSJ Agents are not affected by that list. Do not make the console reachable from the internet.
The Courier server -> your Active Directory, only if you set up a directory account for group audiences (see Audiences). It connects to the domain controller you name, or finds one, and only reads.
The Courier server -> GitHub, only for updates, and only when an administrator asks or has turned on automatic updates (see Updates). Courier sends nothing about you to RSJ Software.

The Windows Firewall rule #

The installer asks whether to add a Windows Firewall rule, Courier (TCP 8445), allowing inbound TCP 8445. It is ticked by default and is removed again when you uninstall. If you manage the firewall by Group Policy, untick it and open the port yourself, scoped to your school's computers.

The certificate #

Courier makes its own certificate for HTTPS, kept in the certs folder of its data folder, so a browser warns about it on the server. That is expected. The deploy script (see Getting Started) records the certificate your server shows, so the agents know they are talking to your Courier server and not something else, and a script saved in Group Policy keeps working when the certificate is renewed with the same key.

Checking it from a computer #

On a computer that cannot be enrolled or does not appear under Agent Settings, Devices, Registered, in PowerShell:

Test-NetConnection courier-server -Port 8445

TcpTestSucceeded : True means the port is reachable. If it is not, check that the server's name resolves from that computer, that the firewall rule exists on the server, and that nothing between them (a network firewall, a VLAN rule) blocks TCP 8445. The Troubleshooting page covers the rest.