We have decided to allow managesieve (tcp port 2000) from external clients. This will allow external tools to log in to the sieve and manage it directly rather than relying on our web-based interface alone. (However, be aware that some clients have TLS incompatibilities that may cause login to fail.)
As such, we have also enabled the ‘managesieve’ plugin for Roundcube webmail and added Avelsieve to SquirrelMail webmail. These interfaces may also be used as an alternative to writing rules directly even if you don’t use webmail.