>>If blocking ports via your router, be aware that your server will need to >>send traffic outbound on ports other than 25. For example, if a remote >>server sends incoming packets on port 25, your responses back to >the remote >>server will be on a random port > 1024. If you only let 25 back out, your >>server will never respond to the remote server. > >THIS IS MISLEADING INFORMATION.
Yes and no. If you do not filter any outbound traffic from your network, than what I had said isn't any issue whatsoever. You are right, any decent router or firewall should allow that traffic without messing around. However, the original post said "...My idea is to only allow traffic on ports 25 inbound/outbound..." I read this as wanting to filter traffic both ways. If using standard Cisco Access Lists, it would be very easy to assume this would work: Interface Serial0 description Internet Backbone access-group acl_in in access-group acl_out out access-list acl_in permit tcp any host 1.2.3.4 25 access-list acl_out permit tcp host 1.2.3.4 any 25 It looks right, everyone on the outside can connect to the mail server located at 1.2.3.4 only on port 25, and my server can contact any host on the Internet, only on port 25. But this does not work, and as you say, essentially denies all inbound and outbound traffic. This, though, is not really a flaw in the equipment, but a flaw in router setup. I wanted to throw this out because I made the same mistake before I knew how Cisco's access lists worked, and ended up denying traffic to my mail server for better than an hour. >Any decent firewall will NOT have this terrible requirement. Any firewall >that has this terrible requirement should be thrown out. Specifically, if >a firewall does have this requirement, no inbound traffic of any sort can >be accepted! Again, this is not a requirement, but if trying to go for maximum security by filtering both incoming and outgoing traffic, this is a VERY EASY config mistake to make. :-) - Tony --- [This E-mail was scanned for viruses by http://www.intouchmi.com] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
