Allow only authorized SMTP servers to communicate with your mail server

12/20/2019 23 21018

DESCRIPTION:

This article describes how to block all traffic from the WAN to a SMTP Server on the LAN or DMZ, except a range of IP Addresses on the WAN. This requirement usually arises when the user has a managed or hosted Spam Filtering service (eg. Postini) on the WAN and wishes to lock-down his incoming email to that service.

RESOLUTION:

Crating an Address Object for the IP Addresses of the hosted service: 

• Login to the SonicWall management interface.
• Navigate to Manage | Policies | Address Objects.
• Create a new Address Object with following values.
  
  Name: Postini Network
  Zone: WAN 
  Type: Network (This could be changed to Range or Host as required)
  Network:  207.126.144.0
   Netmask:  255.255.240.0
  
  
  
• Creating an Address Object for the WAN IP Address of the Mail Server with following values.
  
  Name: Mail Server Public
  Zone: WAN 
  Type: Host
  IP Address: 1.1.1.2
  
  
  
• Creating an Address Object for the LAN (or DMZ) IP Address of the Mail Server with following values.
  
  Name: Mail Server Private
  Zone: LAN  (This could be changed to the zone of the Mail Server)
  Type: Host
  IP Address: 192.168.1.2
  

Creating a WAN to LAN or DMZ allow rule:

• Navigate to the Manage | Policies | Rules | Access Rules page.
• Select From  WAN  To  LAN (This could be changed to the zone of the Mail Server).
• Add the following Allow Rule.
  
  Action: Allow
  Service: SMTP
  Source: Positini Network
  Destination: Mail Server Public
  

Creating a NAT Policy

• Navigate to the Manage | Policies | Rules | NAT Policies page.
• Create a new NAT Policy with following values.
  
  Original Source: Positini Network
  Translated Original: Original
  Original Destination: Mail Server Public
  Translated Destination: Mail Server Private
  Original Service: SMTP
  Translated Service: Original
  Inbound Interface: X1
  Outbound Interface: Any
• Check Create a reflexive policy: This will create an outbound NAT Policy with Original Source as the private IP and the Translated Source as the public IP of the mail server.

How to Test

From a computer on the Internet try to telnet on port 25 to the public ip address of the Mail Server and it should fail. Likewise, try sending a mail and you should be able to receive it.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Crating an Address Object for the IP Addresses of the hosted service

• Login to the SonicWall management interface.
• Navigate to Network | Address Objects.
• Create a new Address Object with following values.
  
  Name: Postini Network
  Zone: WAN
  Type: Network (This could be changed to Range or Host as required)
  Network:  207.126.144.0
   Netmask:  255.255.240.0
  
  
  
• Creating an Address Object for the WAN IP Address of the Mail Server with following values.
  
  Name: Mail Server Public
  Zone: WAN 
  Type: Host
  IP Address: 1.1.1.2
  
  
  
• Creating an Address Object for the LAN (or DMZ) IP Address of the Mail Server with following values.
  
  Name: Mail Server Private
  Zone: LAN  (This could be changed to the zone of the Mail Server)
  Type: Host
  IP Address: 192.168.1.2
  

Creating a WAN to LAN or DMZ allow rule

• Navigate to the Firewall | Access Rules page.
• Select From  WAN  To  LAN (This could be changed to the zone of the Mail Server).
• Add the following Allow Rule.
  
  Action: Allow
  Service: SMTP
  Source: Positini Network
  Destination: Mail Server Public
  

Creating a NAT Policy

• Navigate to the Network | NAT Policies page.
• Create a new NAT Policy with following values.
  
  Original Source: Positini Network
  Translated Original: Original
  Original Destination: Mail Server Public
  Translated Destination: Mail Server Private
  Original Service: SMTP
  Translated Service: Original
  Inbound Interface: X1
  Outbound Interface: Any
• Check Create a reflexive policy: This will create an outbound NAT Policy with Original Source as the private IP and the Translated Source as the public IP of the mail server.
   

How to Test

From a computer on the Internet try to telnet on port 25 to the public ip address of the Mail Server and it should fail. Likewise, try sending a mail and you should be able to receive it.