>>If blocking ports via your router, be aware that your server will need to
>>send traffic outbound on ports other than 25.  For example, if a remote
>>server sends incoming packets on port 25, your responses back to
>the remote
>>server will be on a random port > 1024.  If you only let 25 back out, your
>>server will never respond to the remote server.
>
>THIS IS MISLEADING INFORMATION.

Yes and no.

If you do not filter any outbound traffic from your network, than what I had
said isn't any issue whatsoever.  You are right, any decent router or
firewall should allow that traffic without messing around.  However, the
original post said "...My idea is to only allow traffic on ports 25
inbound/outbound..."  I read this as wanting to filter traffic both ways.
If using standard Cisco Access Lists, it would be very easy to assume this
would work:

Interface Serial0
 description Internet Backbone
 access-group acl_in in
 access-group acl_out out

access-list acl_in
 permit tcp any host 1.2.3.4 25

access-list acl_out
 permit tcp host 1.2.3.4 any 25

It looks right, everyone on the outside can connect to the mail server
located at 1.2.3.4 only on port 25, and my server can contact any host on
the Internet, only on port 25.  But this does not work, and as you say,
essentially denies all inbound and outbound traffic.  This, though, is not
really a flaw in the equipment, but a flaw in router setup.  I wanted to
throw this out because I made the same mistake before I knew how Cisco's
access lists worked, and ended up denying traffic to my mail server for
better than an hour.

>Any decent firewall will NOT have this terrible requirement.  Any firewall
>that has this terrible requirement should be thrown out.  Specifically, if
>a firewall does have this requirement, no inbound traffic of any sort can
>be accepted!

Again, this is not a requirement, but if trying to go for maximum security
by filtering both incoming and outgoing traffic, this is a VERY EASY config
mistake to make.  :-)

- Tony

---
[This E-mail was scanned for viruses by http://www.intouchmi.com]


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Please visit the Knowledge Base for answers to frequently asked
questions:  http://www.ipswitch.com/support/IMail/

Reply via email to