I wanted to let the list know the outcome of this..
If you are an ISP on a average to large scale with your own DNS.MTAs
and other services that reside on your internal network but are visible
to your host inside your network. Here is a little topology of what I have:
!Internet!<---->GW-ETH0<---->FSwitch<--->MTA,DNS,BLA,BLAH
-ETH1<--->FSwitch<--->Customers
This is a rule I use on my gateway to the world:
iptables -A FORWARD -o Serial0 -p tcp -s xxx.xxx.xxx.xxx --dport 25 -j
ACCEPT
iptables -A FORWARD -o Serial0 -p tcp --dport 25 -j DROP
I do not nat anything on the network. where 'x' is the public ip of the MTA.
All is routed and static
This rule basically states that if you area customer on the network then
you can only use my MTA to send email.
Thanks
--Dave
Eric Shubert wrote:
I believe that's correct.
David Milholen wrote:
I can set rules up on the Gateway to the internet or I can set them
up at each pop site.
My best guess would be set this rule up to say only my mail server is
allowed to send smtp on port 25 correct?
--Dave
Jake Vickers wrote:
David Milholen wrote:
Eric,
It is a host on the network.. He is only running a mail client.
Right, but the virus would be spewing emails from the client machine
- it kinda setups up an outgoing smtp service to send emails with.
This is why most ISPs these days will allow port 25 traffic from
their clients, but only to the ISPs mail servers. They can stop
rogue viruses from becoming spam geysers this way.
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
