Stephen: Here my two cents.
We use pktfilter. It works quite well. It took us a while to configure it,
because we had to configure not only POP, SMT and WEBMAIL but DNS as well.
I am attaching a txt file with the rules we use in our server. We have
different ranges of IPs in the box, so if you have one range or one IP, some
lines could be deleted.
If you need to add port 80 navegation, just let me know to send you the set
of rules. Although they are very simple to configure.
I hope this helps Imail administrator using pktfilter
I am also copying the txt file down here for archiving purposes.
-Luis
----
####BEGIN of RULES PKTFILTER
#### default policy = block everything
block in on eth1 all
block out on eth1 all
########### Allow POP3 ALL
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port =
110
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 110 to any port >
1023 established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 110 to any port >
1023 established
########### Allow WEBMAIL and CALENDAR
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port =
8383
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port =
8484
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 8383 to any port >
1023 established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 8484 to any port >
1023 established
########### Allow SMTP
pass in on eth1 proto tcp from any port = 25 to xxx.xxx.xxx.AAA port > 1023
pass in on eth1 proto tcp from any port = 25 to xxx.xxx.xxx.BBB/28 port >
1023
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port =
25
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any port > 1023
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any port >
1023
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any
established
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port > 1023 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port > 1023 to any port =
25
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any port =
25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 5025 to any
established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 5025 to any
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA to any port = 25 established
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 5025 to any
established
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 5025 to any
########## Allow DNS
pass in on eth1 proto udp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA
port > 1023
pass in on eth1 proto udp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA
port > 1023
pass in on eth1 proto udp from xxx.xxx.xxx.EEE port = 53 to
1xxx.xxx.xxx.GGG/24 port > 1023
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to
1xxx.xxx.xxx.GGG/24 port > 1023
pass in on eth1 proto tcp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA
port > 1023
pass in on eth1 proto tcp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA
port > 1023
pass in on eth1 proto tcp from xxx.xxx.xxx.EEE port = 53 to
1xxx.xxx.xxx.GGG/24 port > 1023
pass in on eth1 proto tcp from xxx.xxx.xxx.FFF port = 53 to
1xxx.xxx.xxx.GGG/24 port > 1023
pass in on eth1 proto udp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA
port = 53
pass in on eth1 proto udp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA
port = 53
pass in on eth1 proto tcp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA
port = 53
pass in on eth1 proto tcp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA
port = 53
pass in on eth1 proto udp from xxx.xxx.xxx.EEE port = 53 to
1xxx.xxx.xxx.GGG/24 port = 53
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to
1xxx.xxx.xxx.GGG/24 port = 53
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to
1xxx.xxx.xxx.GGG/24 port > 1023
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to
1xxx.xxx.xxx.GGG/24 port > 1023
pass out on eth1 proto udp from xxx.xxx.xxx.AAA port > 1023 to
xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto udp from xxx.xxx.xxx.AAA port > 1023 to
xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto udp from 1xxx.xxx.xxx.GGG/24 port > 1023 to
xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto udp from 1xxx.xxx.xxx.GGG/24 port > 1023 to
xxx.xxx.xxx.FFF port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.FFF port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.FFF port = 53
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port > 1023 to
xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port > 1023 to
xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto tcp from 1xxx.xxx.xxx.GGG/24 port > 1023 to
xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto tcp from 1xxx.xxx.xxx.GGG/24 port > 1023 to
xxx.xxx.xxx.FFF port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.FFF port = 53
###END OF THE RULES
-------------------------What the xxx.xxx.xxx means in the table above
xxx.xxx.xxx.AAA: An IP address in our Imail Server in a different range from
the one below (xxx.xxx.xxx.BBB)
xxx.xxx.xxx.BBB: A range of IP address in our Imail Server
xxx.xxx.xxx.CCC: Primary DNS IP address
xxx.xxx.xxx.DDD Secondary DNS IP address
xxx.xxx.xxx.EEE: Another DNS Ip address
xxx.xxx.xxx.FFF: and Another DNS Ip address
xxx.xxx.xxx.GGG: a full range of IP address configured in our Imail Server
NIC. It covers ip address in the xxx.xxx.xxx.BBB range.
eth1 is the ID of our external NIC card. Could be eth0 or eth2 depends on
your configuration.
Port 5025 : used in IIS to prevent conflicts with IMAIL
As for the /28 and /24 those are switches to configure a range of address.
/28 means 255.255.255.0 and /28 means 255.255.255.240
here is a table that will give you the idea how everything works with
ranges.
Mask value: # of
Hex CIDR Decimal addresses Classfull
80.00.00.00 /1 128.0.0.0 2048 M 128 A
C0.00.00.00 /2 192.0.0.0 1024 M 64 A
E0.00.00.00 /3 224.0.0.0 512 M 32 A
F0.00.00.00 /4 240.0.0.0 256 M 16 A
F8.00.00.00 /5 248.0.0.0 128 M 8 A
FC.00.00.00 /6 252.0.0.0 64 M 4 A
FE.00.00.00 /7 254.0.0.0 32 M 2 A
FF.00.00.00 /8 255.0.0.0 16 M 1 A
FF.80.00.00 /9 255.128.0.0 8 M 128 B
FF.C0.00.00 /10 255.192.0.0 4 M 64 B
FF.E0.00.00 /11 255.224.0.0 2 M 32 B
FF.F0.00.00 /12 255.240.0.0 1024 K 16 B
FF.F8.00.00 /13 255.248.0.0 512 K 8 B
FF.FC.00.00 /14 255.252.0.0 256 K 4 B
FF.FE.00.00 /15 255.254.0.0 128 K 2 B
FF.FF.00.00 /16 255.255.0.0 64 K 1 B
FF.FF.80.00 /17 255.255.128.0 32 K 128 C
FF.FF.C0.00 /18 255.255.192.0 16 K 64 C
FF.FF.E0.00 /19 255.255.224.0 8 K 32 C
FF.FF.F0.00 /20 255.255.240.0 4 K 16 C
FF.FF.F8.00 /21 255.255.248.0 2 K 8 C
FF.FF.FC.00 /22 255.255.252.0 1 K 4 C
FF.FF.FE.00 /23 255.255.254.0 512 2 C
FF.FF.FF.00 /24 255.255.255.0 256 1 C
FF.FF.FF.80 /25 255.255.255.128 128 1/2 C
FF.FF.FF.C0 /26 255.255.255.192 64 1/4 C
FF.FF.FF.E0 /27 255.255.255.224 32 1/8 C
FF.FF.FF.F0 /28 255.255.255.240 16 1/16 C
FF.FF.FF.F8 /29 255.255.255.248 8 1/32 C
FF.FF.FF.FC /30 255.255.255.252 4 1/64 C
FF.FF.FF.FE /31 255.255.255.254 2 1/128 C
FF.FF.FF.FF /32 255.255.255.255 This is a single host route
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Klinge
Sent: Friday, February 06, 2004 7:01 PM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] The use of a firewall
Jeff.. Here is a free one that works really well with w2k server:
http://www.famhost.com/support/pktfilter.zip
Hth,
~Rick
>> Would not suggest using a software based firewall that is
>> installed on the server. An external appliance is best. If
>> you have a small budget a WatchGuard Firebox x500 would do nicely.
>
>
> Are there others suggestion for firewall software for the
> server. Does Zonealarm have a server version and if so does
> it work as well as Black Ice.
___________________________________________________________________
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
______
[Email scanned for viruses by Panda Consulting -www.pandacons.com-]
[Email escaneado contra virus por Panda Consulting -www.pandacons.com-]
####BEGIN of RULES PKTFILTER
#### default policy = block everything
block in on eth1 all
block out on eth1 all
########### Allow POP3 ALL
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port = 110
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 110 to any port > 1023
established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 110 to any port > 1023
established
########### Allow WEBMAIL and CALENDAR
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port = 8383
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port = 8484
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 8383 to any port > 1023
established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 8484 to any port > 1023
established
########### Allow SMTP
pass in on eth1 proto tcp from any port = 25 to xxx.xxx.xxx.AAA port > 1023
pass in on eth1 proto tcp from any port = 25 to xxx.xxx.xxx.BBB/28 port > 1023
pass in on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.BBB/28 port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any port > 1023
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any port > 1023
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any established
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port > 1023 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port > 1023 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 25 to any
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 5025 to any established
pass out on eth1 proto tcp from xxx.xxx.xxx.BBB/28 port = 5025 to any
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 25 to any
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA to any port = 25 established
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA to any port = 25
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 5025 to any established
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port = 5025 to any
########## Allow DNS
pass in on eth1 proto udp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA port >
1023
pass in on eth1 proto udp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA port >
1023
pass in on eth1 proto udp from xxx.xxx.xxx.EEE port = 53 to 1xxx.xxx.xxx.GGG/24 port
> 1023
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to 1xxx.xxx.xxx.GGG/24 port
> 1023
pass in on eth1 proto tcp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA port >
1023
pass in on eth1 proto tcp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA port >
1023
pass in on eth1 proto tcp from xxx.xxx.xxx.EEE port = 53 to 1xxx.xxx.xxx.GGG/24 port
> 1023
pass in on eth1 proto tcp from xxx.xxx.xxx.FFF port = 53 to 1xxx.xxx.xxx.GGG/24 port
> 1023
pass in on eth1 proto udp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA port = 53
pass in on eth1 proto udp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA port = 53
pass in on eth1 proto tcp from xxx.xxx.xxx.CCC port = 53 to xxx.xxx.xxx.AAA port = 53
pass in on eth1 proto tcp from xxx.xxx.xxx.DDD port = 53 to xxx.xxx.xxx.AAA port = 53
pass in on eth1 proto udp from xxx.xxx.xxx.EEE port = 53 to 1xxx.xxx.xxx.GGG/24 port
= 53
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to 1xxx.xxx.xxx.GGG/24 port
= 53
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to 1xxx.xxx.xxx.GGG/24 port
> 1023
pass in on eth1 proto udp from xxx.xxx.xxx.FFF port = 53 to 1xxx.xxx.xxx.GGG/24 port
> 1023
pass out on eth1 proto udp from xxx.xxx.xxx.AAA port > 1023 to xxx.xxx.xxx.CCC port =
53
pass out on eth1 proto udp from xxx.xxx.xxx.AAA port > 1023 to xxx.xxx.xxx.DDD port =
53
pass out on eth1 proto udp from 1xxx.xxx.xxx.GGG/24 port > 1023 to xxx.xxx.xxx.EEE
port = 53
pass out on eth1 proto udp from 1xxx.xxx.xxx.GGG/24 port > 1023 to xxx.xxx.xxx.FFF
port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto udp from any port > 1023 to xxx.xxx.xxx.FFF port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto udp from any port = 53 to xxx.xxx.xxx.FFF port = 53
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port > 1023 to xxx.xxx.xxx.CCC port =
53
pass out on eth1 proto tcp from xxx.xxx.xxx.AAA port > 1023 to xxx.xxx.xxx.DDD port =
53
pass out on eth1 proto tcp from 1xxx.xxx.xxx.GGG/24 port > 1023 to xxx.xxx.xxx.EEE
port = 53
pass out on eth1 proto tcp from 1xxx.xxx.xxx.GGG/24 port > 1023 to xxx.xxx.xxx.FFF
port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.CCC port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.DDD port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.EEE port = 53
pass out on eth1 proto tcp from any port > 1023 to xxx.xxx.xxx.FFF port = 53
###END OF THE RULES
-------------------------What the xxx.xxx.xxx means in the table above
xxx.xxx.xxx.AAA: An IP address in our Imail Server in a different range from the one
below (xxx.xxx.xxx.BBB)
xxx.xxx.xxx.BBB: A range of IP address in our Imail Server
xxx.xxx.xxx.CCC: Primary DNS IP address
xxx.xxx.xxx.DDD Secondary DNS IP address
xxx.xxx.xxx.EEE: Another DNS Ip address
xxx.xxx.xxx.FFF: and Another DNS Ip address
xxx.xxx.xxx.GGG: a full range of IP address configured in our Imail Server NIC. It
covers ip address in the xxx.xxx.xxx.BBB range.
eth1 is the ID of our external NIC card. Could be eth0 or eth2 depends on your
configuration.
Port 5025 : used in IIS to prevent conflicts with IMAIL
As for the /28 and /24 those are switches to configure a range of address.
/28 means 255.255.255.0 and /28 means 255.255.255.240
here is a table that will give you the idea how everything works with ranges.
Mask value: # of
Hex CIDR Decimal addresses Classfull
80.00.00.00 /1 128.0.0.0 2048 M 128 A
C0.00.00.00 /2 192.0.0.0 1024 M 64 A
E0.00.00.00 /3 224.0.0.0 512 M 32 A
F0.00.00.00 /4 240.0.0.0 256 M 16 A
F8.00.00.00 /5 248.0.0.0 128 M 8 A
FC.00.00.00 /6 252.0.0.0 64 M 4 A
FE.00.00.00 /7 254.0.0.0 32 M 2 A
FF.00.00.00 /8 255.0.0.0 16 M 1 A
FF.80.00.00 /9 255.128.0.0 8 M 128 B
FF.C0.00.00 /10 255.192.0.0 4 M 64 B
FF.E0.00.00 /11 255.224.0.0 2 M 32 B
FF.F0.00.00 /12 255.240.0.0 1024 K 16 B
FF.F8.00.00 /13 255.248.0.0 512 K 8 B
FF.FC.00.00 /14 255.252.0.0 256 K 4 B
FF.FE.00.00 /15 255.254.0.0 128 K 2 B
FF.FF.00.00 /16 255.255.0.0 64 K 1 B
FF.FF.80.00 /17 255.255.128.0 32 K 128 C
FF.FF.C0.00 /18 255.255.192.0 16 K 64 C
FF.FF.E0.00 /19 255.255.224.0 8 K 32 C
FF.FF.F0.00 /20 255.255.240.0 4 K 16 C
FF.FF.F8.00 /21 255.255.248.0 2 K 8 C
FF.FF.FC.00 /22 255.255.252.0 1 K 4 C
FF.FF.FE.00 /23 255.255.254.0 512 2 C
FF.FF.FF.00 /24 255.255.255.0 256 1 C
FF.FF.FF.80 /25 255.255.255.128 128 1/2 C
FF.FF.FF.C0 /26 255.255.255.192 64 1/4 C
FF.FF.FF.E0 /27 255.255.255.224 32 1/8 C
FF.FF.FF.F0 /28 255.255.255.240 16 1/16 C
FF.FF.FF.F8 /29 255.255.255.248 8 1/32 C
FF.FF.FF.FC /30 255.255.255.252 4 1/64 C
FF.FF.FF.FE /31 255.255.255.254 2 1/128 C
FF.FF.FF.FF /32 255.255.255.255 This is a single host route
