Skip to main content
A
Anonymous_User
Contributor
August 8, 2007
Question

Blocking outbound SMTP

  • August 8, 2007
  • 5 replies
  • 4591 views
We are running an internal mail server, and I am trying to block all outbound mail EXCEPT for the mail server. What I am trying to do is ALLOW ALL from the mail server as my first rule, then DENY ALL SMTP for my second rule. 3rd rule is ALLOW ALL. After adding the first rule, I tried to send an email, and found that outbound SMTP seems to be getting timed out. I don' t have any blocking rules set up yet! We also have NAT and port redirection for all incoming SMTP to the mail server. Any suggestions?

    5 replies

    abelio
    SuperUser
    abelio
    SuperUser
    August 8, 2007
    Your second policy is also blocking your internal hosts could reach your internal email server 25/TCP port; you need to be able to contact your server, so it will can send email outwards
    A
    Anonymous_UserAuthor
    Contributor
    August 8, 2007
    Ok- Here are the rules for inbound: 14 Mail Server all always ANY ACCEPT 12 all all always Virus DENY (blocks udp port 19666 only) 6 Local Lan all always ANY ENCRYPT 1 all all always ANY ACCEPT And here are the rules for inbound: 2 all SMTP Mail always SMTP ACCEPT 3 all POP3 always POP3 ACCEPT 4 all WEB Mail always HTTP ACCEPT 8 all WEB / HTTPS always HTTPS ACCEPT 9 all OthercmpSMTP always ANY ACCEPT 10 all OthercmpHTTP always ANY ACCEPT 11 all OthercmpHTTPS always ANY ACCEPT If I enable rule 14, no email can go out. Everything works fine with it disabled. This should work!!! I have not created the rule to block all SMTP outbound yet, because rule 14 doesnt want to work. Help! Steve
    doshbass
    doshbass
    New Member
    August 8, 2007
    Given that the top set of rules are actually outbound rules and rule 1 is not working. Check the obvious things. Is the mail server address right. Have you enabled the NAT checkbox on the rule
    A
    Anonymous_UserAuthor
    Contributor
    August 8, 2007
    DOH! NAT was unchecked! Thanks, working fine now. Steve
    doshbass
    doshbass
    New Member
    August 8, 2007
    Doh! Sometimes its very easy to not see the wood for the trees. Been there done that, don' t worry you have lost no credibility. Jon
    Terms & ConditionsAccessibility statement