Close port 25 for MTA

Question

I've got a customer with an XG310 firmware 18.5.1. 
 They have the MTA fully in use but they like to have there mail delivered on port 587. So i changed the auto added firewall rule, and that is working well. 
 Mail is coming from there antispam provider on port 587 and processed by the MTA successfully. 
 Now the customer wants to close down port 25 completely, so I removed SMTP service from the firewall rule, and everything is still working fine. 
 But I still can connect to port 25 from everywhere in the world. It won't let deliver mail on the port but I still can connect to it and do some commands. 
 Also a general drop or reject rule for smtp on top the firewall rules don't change that. 
 The latest i can confirm with my one company firewall, cannot block access from unwanted regions to smtp MTA. 
 Does anyone know where to start with this? 
 
 Thanks,

rfcat_vk · Accepted Answer

Hi, 
 you would need to build DNAT directing port 25 to a dead-end address, but even then I am not 100% sure that will catch all because port 25 is a XG system port which from memory sees all traffic before the traffic is passed to the firewall rules. 
 Ian

Close port 25 for MTA

Top Replies