SMTP inbound port config

[Mike_Berube]

Hello, I’m setting up a Mail server on my network. I opened port 25 inbound on my server but for some reason when I use telnet to test the connection to my mail server from an external PC I can’t connect through the firewall. Can anybody point me in the right direction in regards to configuration the firewall to accept inbound email and redirect them to my mail server internally please? TY Mike

[Mike_Berube]

I think I got it. This is what I got configured: Port web to port internal: Source: ALL Destination: Mailserver (external Internet IP to Mail server internal IP) (Virtual IP mapping) Service: SMTP Action: Accept Does this look secure? Mike

[ede_pfau]

Yes that' s the way to go. You could narrow the VIP down to port-forward only port 25. But then you will lose the reply-traffic NAT the VIP does automatically. You' d have to create an IP pool and outbound NAT to mimic this. Not worth the effort, securitywise, IMHO as the firewall policy takes care of port filtering. On the contrary, you could allow port 25 and port 587 (which is RFC as well) in a policy with no effort, but with greater hassle in (two) VIPs. What I' d add is IPS signatures against flooding or repeated authentication attempts.

[Fullmoon]

ORIGINAL: ede_pfau What I' d add is IPS signatures against flooding or repeated authentication attempts.

Hi Ede, Could you post your sreenshot here to serve as our basis protecting our client mail server. Thanks

[Mike_Berube]

But then you will lose the reply-traffic NAT the VIP does automatically.

Hello, I' m not sure I understand this. I already have port filtering port 25 to port 25 configured in ViP. What does your quote above imply? What will this configuration prevent from working? TY Mike

[ede_pfau]

What I mean is just a standard DoD policy. This has been made much easier since v4.2. As all connection attempts are using TCP configure a TCP flood sensor where you limit the number of connections per time interval per source IP address. The UTM Guide has all that you need about it. I don' t run a mailserver myself so this is just an advice not a practise in effect.

[ede_pfau]

A VIP without port mapping does not only destination NAT but source NAT as well for the reply traffic. If you enable port mapping the reply traffic is not NATted, that is, the source adresses will be the real (private) IPs, not the server' s public IP which is specified in the VIP. You have to enable NAT in the policy to make thre reply traffic routeable, or even specify an IP pool to have it NATted to a specific IP. Basic function is not affected besides the need to enable NAT explicitly.

[Mike_Berube]

If I try to disable the port forwarding from my mail server ViP configuration I get this error message : A duplicate entry already exists. In fact all my ViP configs all have port forwarding enabled since I can’t save the entry if PW is not enable. What am I doing wrong?

[rwpatterson]

If you do not use port forwarding, then only one definition can be made between the interfaces. Port forwarding allows you do do more than one mapping, losing the innate ability to have the return traffic autmatically forwarded with the VIP address. That small bit can be overcome with the use of an IP pool.

[ede_pfau]

It' s just what it says: you have multiple VIPs for one public IP. You can have either one VIP without port forwarding or multiple VIPs for single ports. Note that OTOH you can have multiple VIPs for different public IPs that point to the same mapped internal IP.