* Re: Vijay - port 25 to be blocked (nfcan: addressed to exclusive sender for this address)
[not found] <200412281624.iBSGOEHc027426@gourmet.spamgourmet.com>
@ 2004-12-28 18:05 ` Jim Laurino
0 siblings, 0 replies; only message in thread
From: Jim Laurino @ 2004-12-28 18:05 UTC (permalink / raw)
To: netfilter
On 2004.12.28 11:22, Vijay Kumar - vijay@calsoftinc.com wrote:
> Hi,
>
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following :
>
> iptables -I INPUT -I eth0 --dport 25 -d !<ip addr of mail server> -j
> REJECT
>
> This does not seem to block the port 25 traffic. Where am I going wrong?
The INPUT rules only apply to packets destined for the firewall computer.
Try this in FORWARD instead.
Another thing, a default drop policy might be simpler to administer.
Then only specifically allowed packets would be forwarded.
This approach more closely matches your intention, stated above.
Also, the approach above is hard to extend to multiple mail servers.
If you do this though, it is a good idea to log unexpected dropped
packets and analyze them to see what is being blocked.
>
> Kindly help.
>
> Regards,
> Vijay Kumar
>
--
Jim Laurino
nfcan.x.jimlaur@dfgh.net
Please reply to the list.
Only mail from the listserver reaches this address.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2004-12-28 18:05 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <200412281624.iBSGOEHc027426@gourmet.spamgourmet.com>
2004-12-28 18:05 ` Vijay - port 25 to be blocked (nfcan: addressed to exclusive sender for this address) Jim Laurino
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox