Block Traffic from IP address range for port 25

[#1]

Hi, I' m not sure if this belongs in Firewall Policies or Routing. I' m a new 100A user. I' ve managed to setup the firewall policies to allow our exchange server to function properly. We are going to try out the Postini email service and I need to block port 25 traffic for all IP' s except for the IP range of the Postini servers (which will be filtering our mail) so that any mail trying to by pass the mail filtering is blocked. How I can go about doing this?

[rwpatterson]

Welcome to the forums. Basically, since the default action of any Fortigate is to block, simply allow port 25 to the IP range for those Postini servers. Create an address entity with the IP range (xxx.xxx.xxx.[starting number-ending number]). Create a second entity for your Exchange server. If the mail is outbound, create a policy allowing traffic from the Exchange server to the Postini server range, and select SMTP for the service. A caveat here. FGT processes policies from the top of the list to the bottom, so place the more restrictive policies at the top of the list, and the more general near the bottom. If the service is inbound, you' ll need to create a Virtual IP for the Exchange server, because the FGT will need to know what outside IP will point to the server. Go to Firewall - Virtual IP - Create New. Here select the external IP address, the internal server address, and set the port to 25. If you do not select a port here, all traffic for that IP address will now be pointed to your Exchange server. Not good. Makes troubleshooting a real pain later. Then just as above, create the policy, source all, destination that VIP rule just created, and service again 25. Good luck.

[#3]

Thanks for the quick reply. I just want to make sure I' m doing this right. I' m configuring inbound traffic now. Can I do the following: Under Firewall>Address, I created an IP range for the Postini servers (named " Postini" ) and also for our internal exchange server (named " Exchange" ). The interface is set to " Any" . Under Firewall>Policy, I have inserted a new policy using " Postini" as the Source Address Name, " Exchange" as the Destination Address Name, the service is set to " SMTP" , and the Action is set to " ACCEPT" . This policy has been inserted above the existing policy routing traffic to our mail server. Regarding your comments configuring the inbound service: Under Firewall>Virtual IP, I find that I cannot enter a range for the External IP Address/Range when trying to create a new Virtual IP. I can only enter a single IP address. I not sure why. Thanks again. --- Will

[rwpatterson]

The address you enter here is the address the world (Internet) will use to route mail to your Exchange server. This has to be a legitimate IP address that your ISP provided you. If you only have one IP address, that' s ok. Just use the port forwarding option like I stated in the first reply. Port 25 traffic will head to the Exchange server, and all other traffic will be handled by the FGT.

[#5]

Ah. My mistake. I was so focused on the IP addresses of the Postini servers that I forgot about the role that our IP addresses played. It makes sense now. Anyway, I already have a Virtual IP setup for my exchange servers so that I got an message that an duplicate exists already. So would the following work: I created an IP range for the Postini servers (named " Postini" ) and also for our internal exchange server (named " Exchange" ). The interface is set to " Any" . Under Firewall>Policy, I have inserted the new policy using " Postini" as the Source Address Name, " Exchange" as the Destination Address Name, the service is set to " SMTP" , and the Action is set to " ACCEPT" . This policy has been inserted above the existing policy routing traffic to our mail server. Thanks.

[rwpatterson]

Very logically, look at the source and destination. This will dictate the direction of traffic flow. Also another caveat: Any OUTBOUND policy that borders the Internet has to have NAT enabled. 192.168.x.x addresses are not routable over the Internet. Similarly, you cannot point to 192.168.x.x from the Internet. This is why the destination has to be the VIP rule you created. This is the glue between the outside IP address and the inside one. If by accident you enable NAT on an inward facing policy, all traffic will seem to come from you Fortigate.