Skip to main content
jcm05
jcm05
New Member
November 20, 2016
Question

Routing question on new 300D

  • November 20, 2016
  • 1 reply
  • 3212 views

Our current firewall only accepts email from our cloud spam service which is a specific ip range over port 25. To accomplish this on the 300D do I need to create a VIP with the Interface being (external), external static ip address of firewall, mapped internal (ip of exchange server) port forwarding port 25. Than add source address filter and put the cloud service ip range there to complete the vip.

 

After VIP is complete then and IP4 policy.

    1 reply

    kallbrandt
    kallbrandt
    New Member
    November 20, 2016

    A VIP is a virtual IP. It can be any IP, and it doesn't need to exist on any interface.

     

    With that said - In your case, create a VIP with the external IP you want to use, enable port forwarding for tcp port 25, and set the internal IP to the mailserver address.

     

    Create an address object that contains the IP-range that you want to allow.

     

    Create a firewall policy with source interface wan-interface/zone, and the source address set to your address object containing the IP-range. Set the destination interface to the interface/zone pointing to your internal mailserver, and the destination address to your VIP.

     

    There is no need to use the source filter in the VIP. In my opinion, it is better if you keep all the filtering in the policies instead. At least, it gets clearer if you can see everything you filter on.

     

    Do as you wish. If you filter source IP in the VIP, the firewall policy should have the source address set to "all".

     

    MikePruett
    MikePruett
    New Member
    November 20, 2016

    Richie covered it perfectly

     

    Also, Be certain to only do it for the ports necessary and not the whole IP. That can hurt you if you are trying to access the device remotely etc.

    Terms & ConditionsAccessibility statement