Skip to main content
Mike_Berube
Mike_Berube
New Member
May 27, 2011
Question

SMTP inbound port config

  • May 27, 2011
  • 6 replies
  • 4703 views
Hello, I’m setting up a Mail server on my network. I opened port 25 inbound on my server but for some reason when I use telnet to test the connection to my mail server from an external PC I can’t connect through the firewall. Can anybody point me in the right direction in regards to configuration the firewall to accept inbound email and redirect them to my mail server internally please? TY Mike

    6 replies

    Mike_Berube
    Mike_BerubeAuthor
    New Member
    May 27, 2011
    I think I got it. This is what I got configured: Port web to port internal: Source: ALL Destination: Mailserver (external Internet IP to Mail server internal IP) (Virtual IP mapping) Service: SMTP Action: Accept Does this look secure? Mike
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 28, 2011
    Yes that' s the way to go. You could narrow the VIP down to port-forward only port 25. But then you will lose the reply-traffic NAT the VIP does automatically. You' d have to create an IP pool and outbound NAT to mimic this. Not worth the effort, securitywise, IMHO as the firewall policy takes care of port filtering. On the contrary, you could allow port 25 and port 587 (which is RFC as well) in a policy with no effort, but with greater hassle in (two) VIPs. What I' d add is IPS signatures against flooding or repeated authentication attempts.
    Fullmoon
    Fullmoon
    New Member
    May 28, 2011
    ORIGINAL: ede_pfau What I' d add is IPS signatures against flooding or repeated authentication attempts.
    Hi Ede, Could you post your sreenshot here to serve as our basis protecting our client mail server. Thanks
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 30, 2011
    What I mean is just a standard DoD policy. This has been made much easier since v4.2. As all connection attempts are using TCP configure a TCP flood sensor where you limit the number of connections per time interval per source IP address. The UTM Guide has all that you need about it. I don' t run a mailserver myself so this is just an advice not a practise in effect.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 30, 2011
    A VIP without port mapping does not only destination NAT but source NAT as well for the reply traffic. If you enable port mapping the reply traffic is not NATted, that is, the source adresses will be the real (private) IPs, not the server' s public IP which is specified in the VIP. You have to enable NAT in the policy to make thre reply traffic routeable, or even specify an IP pool to have it NATted to a specific IP. Basic function is not affected besides the need to enable NAT explicitly.
    Mike_Berube
    Mike_BerubeAuthor
    New Member
    May 30, 2011
    If I try to disable the port forwarding from my mail server ViP configuration I get this error message : A duplicate entry already exists. In fact all my ViP configs all have port forwarding enabled since I can’t save the entry if PW is not enable. What am I doing wrong?
    rwpatterson
    rwpatterson
    New Member
    May 31, 2011
    If you do not use port forwarding, then only one definition can be made between the interfaces. Port forwarding allows you do do more than one mapping, losing the innate ability to have the return traffic autmatically forwarded with the VIP address. That small bit can be overcome with the use of an IP pool.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 31, 2011
    It' s just what it says: you have multiple VIPs for one public IP. You can have either one VIP without port forwarding or multiple VIPs for single ports. Note that OTOH you can have multiple VIPs for different public IPs that point to the same mapped internal IP.
    Terms & ConditionsAccessibility statement