# Microsoft Teams which ports **URL:** \ **Category:** Installing & Running IPFire\ **Created:** [31 August 2020 19:28 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119 "2020-08-31T19:28:33Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [31 August 2020 19:28 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/1 "2020-08-31T19:28:33Z")
Anyone know how to get the dreaded microsoft teams to be allowed through IPFIRE. without compromising security? ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [31 August 2020 19:38 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/2 "2020-08-31T19:38:24Z")
Hi, > Anyone know how to get the dreaded microsoft teams to be allowed through IPFIRE. let me google that for you: > **[Archived - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/contentarchivals/contentarchivedpage/message-uid/28417)** > […] without compromising security? Well, looking at the ports and IP networks MS Teams requires: No. Honestly, the link above lists a /14 to be allowed, which covers 262,144 single IPv4 addresses. Speaking of security if a vendor forces you to permit traffic to a network that big is naive. At least for `microsoft.com` and `msn.com`, Microsoft is not even able to keep track of their subdomains, allowing them to be hijacked for malicious purposes: > **[Microsoft has a subdomain hijacking problem](https://www.zdnet.com/article/microsoft-has-a-subdomain-hijacking-problem/)** > > Spammers hijack Microsoft subdomains to advertise poker casinos. Many other subdomains have been vulnerable for years. In my opinion, Microsoft products are intrinsically insecure. Thanks, and best regards, Peter Müller ---
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [31 August 2020 21:58 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/3 "2020-08-31T21:58:06Z")
Tell me about it. I have to deal with all kinds of trouble once microsoft is needed. Microsoft is absolute junk in my opinion, but that is my opinion. That said I will have to make it work as that is required. I can also google for the ports. In the end you get 65536 ports needed to be open if you google long enough. It is non sensical. My question was directed to someone who is in the same situation as I and have to deal with getting Teams to work through IPFire securely and who done so successfully. Not if I can or want to google. Dont trust the google port info. Makes little sense. ---
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [1 September 2020 18:45 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/4 "2020-09-01T18:45:32Z")
Teams works without any change in ipfire… And even worked with 90% of countries in blocklist… (exit traffic blocked based on country destination - which was literally a pain in the rear for all Microsoft apps!). At that time I had to add this rule in FW CUSTUMFORWARD chain to allow the access to Microsoft IP ranges… > msft=`curl -k https://rdap.arin.net/registry/entity/MSFT 2>/dev/null |grep v4prefix -A1 |tr -d '",: \n-' |sed -e 's/v4prefix/,/g' |sed -e 's/length/\//g' |sed -e 's/^,//g'` > iptables --wait -t filter -A CUSTOMFORWARD -p tcp --dport 443 -d $msft -j ACCEPT > iptables --wait -t filter -A CUSTOMFORWARD -p tcp --dport 80 -d $msft -j ACCEPT ---
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [2 September 2020 01:38 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/5 "2020-09-02T01:38:59Z")
This is very helpful thanks. Educate me. The curl/sed bash command fetches ranges of ip addresses. Which Ip addresses are these for? The countries you mention ? I see in the iptables string that these are then set to be accepted and port forwarded to somewhere. In my case it would be great to just forward them to exactly the machines who needs this and runs Teams and not made available to other servers who do not need such connection. ---
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [2 September 2020 08:05 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/6 "2020-09-02T08:05:15Z")
Hi, > [@zimbodel](#): > > Which Ip addresses are these for? These are **ALL Microsoft public registered IP** addresses. > [@zimbodel](#): > > The countries you mention ? Because I blocked 90% of the countries, this means I blocked also Microsoft IP ranges registered in those countries! And with DNS responses not being always GeoIP aware, I was getting sometimes IP address from countries I blocked (like Italy). For these cases the apps did not worked… until DNS responded back with a new IP from another country. Therefore the only solution was to permit Microsoft IP ranges explicitly in the one of the FW Chains Prior to the Chain where country block was enforced. > [@zimbodel](#): > > I see in the iptables string that these are then set to be accepted and port forwarded to somewhere. > In my case it would be great to just forward them to exactly the machines who needs this and runs Teams and not made available to other servers who do not need such connection. Those are just Permit **TCP 443 and TCP 80 for OUTGOING traffic**. This was enough for all MS Apps to work properly - including Teams. I am not a Microsoft expert, but I believe they use some kind of HTTPS proxy for all their apps… At least this is what I see in Outlook Connection tracker. I assume that rest of apps use same transport: an SSL bearer… Hope it helps! ---
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [2 September 2020 08:24 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/7 "2020-09-02T08:24:52Z")
This REALLY helps thanks. It would have taken an eternity to figure this out. ---
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [2 September 2020 10:38 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/8 "2020-09-02T10:38:09Z")
Here is my intermediary script that check all Microsoft RDAP database entries and extract from there the CIDR ranges > #!/bin/bash > > curl -o MSFT-RDAP [https://rdap.arin.net/registry/entity/MSFT](https://rdap.arin.net/registry/entity/MSFT) > grep v4prefix -A 1 MSFT-RDAP | awk ‘{gsub(/--/,“,”); printf $0}’|awk ‘{gsub(/ "v4prefix" : "/,“”); printf $0}’|awk ‘{gsub(/ "length" : /,“/”); printf $0}’|awk ‘{gsub(/",/,“”); printf $0}’ \> MSFT-RDAP2CIDR > cat MSFT-RDAP2CIDR ---
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [3 September 2020 10:00 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/9 "2020-09-03T10:00:09Z")
Thats a neat script and very helpful thanks. I will sure use it ! I always try to avoid sed/awk in my scripts but it is very useful as this demonstrates. I just cant get used to the extreme cryptic commands. You obviously mastered them well. It runs properly for about 4 seconds, then; It gives me a syntax error "syntax error near unexpected token `(’ " , but I will figure out whats wrong. I have to figure out how it works anyway. ``` ./deleteme.scr % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 354k 0 354k 0 0 95806 0 --:--:-- 0:00:03 --:--:-- 95786 ./deleteme.scr: line 6: syntax error near unexpected token `(' ./deleteme.scr: line 6: ` grep v4prefix -A 1 MSFT-RDAP | awk ‘{gsub(/--/,","); printf $0}’|awk ‘{gsub(/ “v4prefix” : “/,”"); printf $0}’|awk ‘{gsub(/ “length” : /,"/"); printf $0}’|awk ‘{gsub(/",/,""); printf $0}’ > MSFT-RDAP2CIDR' ``` ---
**Author:** ![ipfireuser](https://community.ipfire.org/user_avatar/community.ipfire.org/ipfireuser/32/270_2.png) [@ipfireuser](https://community.ipfire.org/u/ipfireuser)\ **Post date:** [14 September 2020 13:33 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/10 "2020-09-14T13:33:27Z")
Hi Guys ! I am using IPfire with web proxy(without transparent mode) and URL filtering I need Microsoft teams work for my network. I have added all IP addresses(from Microsoft website for teams) in my firewall proxy and URL filter unrestricted IP addresses. I have also added URLs for MS-teams in custom white list. But teams desktop app still give me error. Any help? any one can suggest how to make IPfire work with Microsoft teams desktop . error message i am getting now on team desktop is “desktop-10416bd0-6a28-418d-a022-49d7bd78edb2 Error code - 6 There’s a more permanent way to sign in to Microsoft Teams. If you’re having trouble completing the process, talk to your IT admin” ---
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [15 September 2020 16:40 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/11 "2020-09-15T16:40:26Z")
For once Microsoft actually did something useful with Teams. It actually works, but these kinds of questions how to make it work with firewalls is going to pop up more and more. It would be really great and in the benefit of IPFire to create a general setup script or functionality that can solve all these questions and make it easy out of the box to get teams working on IPFire. It will just get way more users for IPFire. I dont like M$, but Teams is going to be a game changer and caught the Open Source community completely off guard. Best is to support it and make it easy for users to use IPFire with it ---
**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\ **Post date:** [15 September 2020 23:53 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/12 "2020-09-15T23:53:43Z")
Here is what I Found hope it helps. > **[Prepare your organization's network for Teams - Microsoft Teams](https://docs.microsoft.com/en-us/microsoftteams/prepare-network)** > > Learn about preparing your organization's network for Microsoft Teams, including network requirements, network optimization, and bandwidth requirements. > **[Ports needed for Microsoft Teams](https://techcommunity.microsoft.com/t5/microsoft-teams/ports-needed-for-microsoft-teams/m-p/28417)** > > Hello, I've been looking for the list of ports (TCP/UDP) that MS Teams needs. Working in a highly secured DEV environment :-) I cannot find the ports required for installation & communications. Anyone a link or a list for me ?  Guess lots of... ---
**Author:** ![ipfireuser](https://community.ipfire.org/user_avatar/community.ipfire.org/ipfireuser/32/270_2.png) [@ipfireuser](https://community.ipfire.org/u/ipfireuser)\ **Post date:** [18 September 2020 14:10 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/13 "2020-09-18T14:10:24Z")
thanks shaun. I have tried that.Teams works for all other domains but now problem seems to i have on site AD server for authentication of users from AD FS server 2012 so even i try to login from web version of teams it first gives me certificate error(as i am using https web proxy with url filtering in IPFIRE). Can some one help me how to solve this certificate warning error? all other https websites working fine but as this office365 redirects user to my organization login page which is on AD FS server 2012 certificate warning comes up. I have added that link ([xyz.myorg.com](http://xyz.myorg.com)) in proxy and url filter also unrestrict ip list but still certificate warning comes up mean man in middle being detected… Thanks ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [19 September 2020 09:43 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/14 "2020-09-19T09:43:23Z")
Hi, > Can some one help me how to solve this certificate warning error? since IPFire’s web proxy is not capable of intercepting HTTPS traffic for security reasons (we’ve compiled Squid without SSL/TLS support), I am pretty sure this is not related to IPFire. > […] which is on AD FS server 2012 certificate warning comes up. If I got this setup right, your AD server is serving the certificate in question. In this case, receiving a certificate warning does not surprise me, since it is most probably not issued by a publicly trusted CA. > I have added that link ([xyz.myorg.com](http://xyz.myorg.com)) in proxy and url filter also unrestrict ip list but still certificate warning comes up mean man in middle being detected Again, this is not necessary. Thanks, and best regards, Peter Müller ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [19 September 2020 09:55 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/15 "2020-09-19T09:55:43Z")
Hi, > [@zimbodel](#): > > It would be really great and in the benefit of IPFire to create a general setup script or functionality that can solve all these questions and make it easy out of the box to get teams working on IPFire. > It will just get way more users for IPFire. in my opinion, this is not the right approach to the problem. At IPFire, we neither can nor want to provide scripts/documentation/how-tos for making 3rd party applications work with IPFire. Their behaviour can change at any time, and maintaining such guides or scripts simply goes beyond our capabilities. Worse, it releases the user from the burden of thinking by themselves and reading the firewall documentation, which I consider to be fatal in terms of security, as the user has no idea about what he/she/it is doing and how the affected system works in detail - some thoughts which I wrote down a while ago here: > **[Information security recommendations for IPFire users - The IPFire Blog](https://blog.ipfire.org/post/information-security-recommendations-for-ipfire-users)** > > As announced last week, this is the first post of a small series containing > security recommendations for IPFire users. The series mainly applies to home > users - which are estimated to roughly make up a third of all IPFire > installations \\- and aims to... > Best is to support it and make it easy for users to use IPFire with it The ultimate goal (gaining more IPFire users) does not justify the means. MS Teams indeed is an ongoing topic heavily advertised my Microsoft themselves, and many people want to use it - although I often get the feeling that they do not know what to use it for, but rather want to have it because it is cool. At least within Europe, legal trouble is an elephant in the room as well, as it is not clear whether it is even legal (GDPR compliant) to use cloud-based Microsoft software, as there is no sufficient privacy level in the US. Taking advantage of the CLOUD act, US intelligence and law enforcement agencies are allowed to demand access to data stored overseas, as long as the data center, servers or whatever is owned by an US-based company. If I may speak for the IPFire project as such: At this point, besides the ongoing efforts for maintaining scripts or documentation to “make MS Teams work with IPFire” without spending a single thought on how a firewall works and how to write rules for it, is not wise, since we cannot give any legal advice whether a user should even use MS Teams. Thanks, and best regards, Peter Müller ---
**Author:** ![zimbodel](https://community.ipfire.org/user_avatar/community.ipfire.org/zimbodel/32/10717_2.png) [@zimbodel](https://community.ipfire.org/u/zimbodel)\ **Post date:** [28 September 2020 19:35 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/16 "2020-09-28T19:35:50Z")
Thanks Peter, As for " whether a user should even use MS Teams. " … Employees have no choice. If they refuse to use it they WILL lose their livelihood. That is a dubious/bogus consideration. Teams is here to stay and here to stay in a BIG way unfortunately. I dislike TEAMS, and I lay the blame on us the open source community for not first developing such a suite. We are getting slack. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [28 September 2020 22:48 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/17 "2020-09-28T22:48:42Z")
Hello @zimbodel, Sorry for taking this in a new direction. I am just trying to learn something about MS Teams and the firewall. I’ve been sitting on the sidelines watching this discussion. My wife uses the client side of MS Teams most all day long without issues. I did not change anything from the out-of-the-box IPFire setup. And I did not need to open any ports for MS Teams. It just works. So what is open on my side that is closed on your side? ---
**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Post date:** [5 September 2023 19:21 UTC](https://community.ipfire.org/t/microsoft-teams-which-ports/3119/18 "2023-09-05T19:21:14Z")
2 posts were split to a new topic: [Microsoft Team won’t connect](https://community.ipfire.org/t/microsoft-team-wont-connect/10301)