UTM-9 port 25,465,587 are opened on all public IPs, can i close some of them?

You can try to create a DNAT rule where you Blacklist all traffic arriving on ports 465 and 587 and where you do the same for port 25 for the 13 IP's that are not "in use".

I think that'll work as DNAT is usually one of the first mechanisms being checked on incoming traffic.

thanks

but there is no block or deny action can be chosen in NAT, unlike firewall rule

I am using UTM-9

thanks

but there is no block or deny action can be chosen in NAT, unlike firewall rule

I am using UTM-9

That's correct, but you can change the destination to an address in the 240.0.0.0/4 subnet. That's a reserved for future use subnet and will not go anywhere, see it like some sort of blackhole where you send all traffic that you don't want inside your network.

Hi Ming and welcome to the UTM Community!

To understand why your firewall rule didn't work, read #2 in Rulz. .  See #3 through #5 for better understanding of specific issues.  Also see Doug Foster's take on some of this: READ ME FIRST: UTM Architecture.

I think you'll want to allow all three ports on the public IP to which your MX record points.  Port 587 is ESMTP and is used not rarely.  Port 465 is used by older servers to send mail and it's essentially SMTP over an SSL-encrypted tunnel.  Both SMTP (25) and ESMTP can establish an encrypted tunnel after the connection is made.

Cheers - Bob