Re: Vijay - port 25 to be blocked (nfcan: addressed to exclusive sender for this address)

Re: Vijay - port 25 to be blocked (nfcan: addressed to exclusive sender for this address)

[Jim Laurino]

On 2004.12.28 11:22, Vijay Kumar - vijay@calsoftinc.com wrote:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following :
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT
> 
> This does not seem to block the port 25 traffic. Where am I going wrong?

The INPUT rules only apply to packets destined for the firewall computer.
Try this in FORWARD instead.

Another thing, a default drop policy might be simpler to administer.
Then only specifically allowed packets would be forwarded.
This approach more closely matches your intention, stated above.
Also, the approach above is hard to extend to multiple mail servers.

If you do this though, it is a good idea to log unexpected dropped
packets and analyze them to see what is being blocked.

> 
> Kindly help.
> 
> Regards,
> Vijay Kumar
>
-- 
Jim Laurino
nfcan.x.jimlaur@dfgh.net
Please reply to the list.
Only mail from the listserver reaches this address.