Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to install Blackberry Express Server on my Exchange 2010 server for users at my company, but I am wary of simply opening up ports to my server directly to the internet.

Are there any good ways to ensure that inbound traffic is blackberry-only and safe? I know Blackberry does allow a seperate server to be installed in the DMZ, although that would really be overkill for my organization.

This is a blackberry article about the firewall requirements:

share|improve this question
up vote 2 down vote accepted

To communicate with the BlackBerry infrastructure, your BES server needs to maintain a bidirectional TCP connection to srp.[country] on port 3101 (the SRP address will vary depending on what country you're in).

If your firewall is any good, you should be able to configure it such that it will only allow traffic on port 3101 between srp.[country] and the internal IP address of your BES server. This rule will ensure that only legitimate BlackBerry traffic goes through your firewall.

share|improve this answer
In addition, the connection is initiated from the BES server, so no inbound rules need to be created on the firewall to allow the BES server to communicate with the RIM network. Assuming you're firewall is configured with the typical ANY>ANY>ALLOWED internal to external rule then no special configuration\rules should be needed. – joeqwerty Dec 15 '10 at 0:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.