This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Drop SMTP Port 25 on one Interface

Hi,
i have an enabled smtp proxy, so on every interface port 25/smtp is open.

How it is possible to block smtp proxy on one interface?
Due to smtp/proxy ruleset is put in auto_ruleset, a packet filter rule on my own will be put into user_ruleset, but auto_rulset allow matches before my user_rulset deny.

I want all ports on that interface filtered, cause this Interface is only used for VPN traffic, and nothin else.

This thread was automatically locked due to age.

0 dayne1432 over 20 years ago

This may work. In your packet filters put a rule that states from any source to destination of that network drop SMTP.
Cancel
Vote Up 0 Vote Down

Cancel
0 maygyver over 20 years ago in reply to dayne1432

will not work, cause user filter rule is never been reached, ause auto filter rule is first.

Astaro user since 2001 - Astaro/Sophos Partner since 2008
Cancel
Vote Up 0 Vote Down

Cancel
0 thtran over 20 years ago in reply to maygyver

Hi!

You will have to use some NAT rules. Redirect traffic to non-VPN-ports on that interface to one of the other interfaces or to 192.168.1.1 or something ...

I'm using DNAT to block SMTP-traffic from some big ISPs to block malware-SMTP from infected PCs.
Cancel
Vote Up 0 Vote Down

Cancel
0 cyclops over 20 years ago

for versions pre 6 it was possible to configure own rules under the hood - search the board for 'ipnat.local'.

Greetings
cyclops
Cancel
Vote Up 0 Vote Down

Cancel
0 maygyver over 20 years ago in reply to cyclops

ipnat.local, is a bad solution I think, the Nat rule works perfect, and you need not to hack in special files.

Astaro user since 2001 - Astaro/Sophos Partner since 2008
Cancel
Vote Up 0 Vote Down

Cancel
0 VelvetFog over 20 years ago

[ QUOTE ]
i have an enabled smtp proxy, so on every interface port 25/smtp is open.

How it is possible to block smtp proxy on one interface?

[/ QUOTE ]While the SMTP proxy will accept incoming mail on all the configured interfaces, it will only relay outgoing mail originating on the networks that you have permitted it to accept outbound mail from in webadmin. As long as you limit it to only forward outbound mail from the Internal network, you don't have an open spam relay security hole.
Cancel
Vote Up 0 Vote Down

Cancel
0 maygyver over 20 years ago in reply to VelvetFog

@VelvetFog
I know, but I want no open port on this special Internet connection, cause I have two of them.

Astaro user since 2001 - Astaro/Sophos Partner since 2008
Cancel
Vote Up 0 Vote Down

Cancel
0 NimmdirKeks over 20 years ago in reply to maygyver

Hi,

NAT is the only way to override some of the AUTO_INPUT filters.
You only need to make a SNAT rule like

from any to interface port smtp change destination port to 99999, so the packet will run into the pf and gets dropped.

Chris
Cancel
Vote Up 0 Vote Down

Cancel
0 omega over 20 years ago

What I really don't understand, that Astaro doesn't allow
this via the webinterface like for dns-proxy or http-proxy.
This is asked frequently.
They could bind exim to specific interfaces (if possible) or
automatically adjust the Paketfilter.
Cancel
Vote Up 0 Vote Down

Cancel
0 NimmdirKeks over 20 years ago in reply to omega

Hi,

because exim binds to all interfaces by default.
Therefore the option Allow Relay from is inserted.

Chris
Cancel
Vote Up 0 Vote Down

Cancel