Re: Vijay - port 25 to be blocked

[ASHISH <ashishis@gmail.com>]

Infact the rule that you have written makes no sense as any packet in
input chain with dport as 25 is meant for your machine's SMTP server.
So if your rule is translated in plain english, it would loook like

"Deny access to all IP addresses other than <ip addr of mail server>
to the mail server running on my machine".

If you are writing this rule to your gateway, just write in it's
FORWARD chain. If you are writing this rule for you company's SMTP
server (if all mail in calsoft is  forwarded to  smtp.calsoftinc.com
and this server in turn forwards it to respective mail servers on net)
then put it in that machine's output chain.


On Tue, 28 Dec 2004 21:52:46 +0530, Vijay Kumar <vijay@calsoftinc.com> wrote:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following :
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT
> 
> This does not seem to block the port 25 traffic. Where am I going wrong?
> 
> Kindly help.
> 
> Regards,
> Vijay Kumar
> 


-- 
cheers
Ashish
KReSIT
IIT Bombay