Skip to content

Stargate Pre-Requisites & Deployment Information

Logo

What is Stargate?

Pre-Requisites

Responsibility Customer

Please ensure that all necessary preparatory steps have been completed before the HIN Gateway migration or new installation activities begin.

The following items must be available or confirmed before the installation:

  • Credentials will be delivered to you by HIN

    • VM credential
    • Keycloak credential
    • Activation code

  • Export of private key

Info

Export of private keys is only for customers moving from existing MGW to a new HIN Gateway

  • If you are working on a Windows machine that has access to the Mail Gateway VM via port 22, we can support you during the call in enabling the private key export from the MGW.
  • If you do not have access to such a machine, please contact HIN Support by email or phone (support@hin.ch / 0848 830 740) to help you establish a support connection via System Administration → Support Connection → Connect.
  • Download latest version of VM image
  • Firewall requirements for WireGuard. Configure the WireGuard port 19818 (TCP/UDP) in your firewall:
    • Incoming and outgoing traffic
    • Allow traffic: any-to-HIN Gateway and HIN Gateway-to-any

  • DHCP access should be available. For more information see "Installation Guidelines".

  • Backup requirements - see "Annex 1 - Backing up and restoring the appliance settings".

Info

Backup requirements is only for customers moving from existing MGW to a new HIN Gateway

  • Confirmation that the existing MGW will not be deleted until acceptance has been completed.

Info

Keeping the existing MGW available till acceptance report have been completed is only for customers moving from existing MGW to a new HIN Gateway

  • Access to DNS, mail server connectors, transport rules, and relay settings.

Deployment Information

Installation Options

🖨️

You can get this documentation printed or saved as PDF, please visit our Print page view.

Exchange Integration

  • Exchange integration - Configure Microsoft Exchange (Online and On-Premises) connectors and transport rules to route mail through Stargate

Server Requirements

  Minimum Recommended
CPU, Cores 4 6
RAM, GB 8 12
SSD, GB 60 60

Common Requirements

  • Root access: Must be run as root or with sudo
  • Supported distributions:
    • RHEL 8, 9 and 10 compatible distributions such as Alma Linux, Rocky Linux, CentOS Stream
    • Ubuntu 22 and 24
    • Debian 11, 12 and 13
  • Real IPv4 address
  • Valid DNS records. Your domain must have:
    • MX records pointing to your mail servers
    • SPF record defining allowed sending networks
    • Server must be able to resolve DNS (MX, SPF, A records)
    • Used for mail routing and SPF-based network allowlisting

Inbound Network Access (firewall must allow)

Firewall note

Depending on your firewall or NAT configuration, you may need to explicitly allow traffic for the required ports. Refer to your firewall and NAT documentation for details.

The VM must be able to accept incoming connections on the required service ports and send responses back to the requester. With a stateful firewall (such as iptables using conntrack), return traffic is automatically allowed by the ESTABLISHED,RELATED rules.

Example iptables configuration:

# Allow return traffic for established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow inbound TCP connections to the open ports
iptables -A INPUT -p tcp -m multiport --dports 25,8084,19818 -j ACCEPT

# Allow outbound TCP connections to the open ports
iptables -A OUTPUT -p tcp -m multiport --dports 25,8084,19818 -j ACCEPT

# Allow inbound UDP port 19818 for Wireguard
iptables -A INPUT -p udp --dport 19818 -j ACCEPT

# Allow outbound UDP port 19818 for Wireguard
iptables -A OUTPUT -p udp --dport 19818 -j ACCEPT

# Additional Services that VM shall be able to reach
# DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# NTP
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# HTTP
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

# HTTPS
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
Port Protocol Purpose
25 TCP SMTP - receiving mail from external servers
8084 TCP HTTP - seal callback from remote sealer service
19818 UDP+TCP WireGuard - encrypted tunnel for agent-to-agent communication. Read our Security Assessment WireGuard

Inbound VM Access (your administrative machine to the HIN Gateway VM)

Info

These firewall rules should be applied only between your administrative machine and the HIN Gateway VM. There is no need to expose these ports to the Internet.

Port Protocol Purpose
80 TCP Redirects HTTP traffic to HTTPS
443 TCP Used to manage the HIN Gateway through the web dashboard
8180 TCP Used by Keycloak to authenticate users for the HIN Gateway dashboard
8190 TCP Optional. Required for troubleshooting and viewing logs
22 TCP Optional. Required for troubleshooting and modifying configuration

Outbound Network Access (server must reach)

Destination Port Protocol Purpose
hub.docker.com 443 TCP Docker image registry
mxengine-dev.k8s.vereign-cdn.com 443 TCP Remote sealer service
smimekeys-ca-dev.k8s.vereign-cdn.com 443 TCP S/MIME CA service
loki.example.com 443 TCP Log shipping (Alloy → Loki, optional)
Update Server of alpine, almalinux, etc. 80 TCP Various Update servers
Destination mail servers 25 TCP Outbound mail delivery (via MX lookup)
Standard DNS queries and responses 53 UDP + TCP DNS resolve
NTP servers 123 UDP NTP synchronizes the clocks of computers, servers, network devices, and virtual machines with accurate time sources

Contact us

Support

For any questions or issues related to the deployment and operation of the HIN Mail (Stargate) appliance, please contact HIN support.

Please include relevant information such as the customer name, appliance version, and screenshots/logs where applicable, to help us process your request efficiently.

documentation commit