Allow only authorized SMTP servers to communicate with your mail server

09/29/2023 42 People found this article helpful 497,843 Views

Description

This article describes how to block all traffic from the WAN to a SMTP Server on the LAN or DMZ, except a range of IP Addresses on the WAN. This requirement usually arises when the user has a managed or hosted Spam Filtering service (eg. Postini) on the WAN and wishes to lock-down his incoming email to that service.

Resolution

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

1) Creating an Address Object for the IP Addresses of the hosted service:

Login to the SonicWall management interface.
Navigate to Object| Match Objects| Addresses.
Create a new Address Object with following values.

Name: Postini Network
Zone: WAN
Type: Network (This could be changed to Range or Host as required)
Network: 207.126.144.0
Netmask: 255.255.240.0

2) Creating an Address Object for the WAN IP Address of the Mail Server with following values.

Name: Mail Server Public
Zone: WAN
Type: Host
IP Address: 1.1.1.2

3) Creating an Address Object for the LAN (or DMZ) IP Address of the Mail Server with following values.

Name: Mail Server Private
Zone: LAN (This could be changed to the zone of the Mail Server)
Type: Host
IP Address: 192.168.1.2

4) Creating a WAN to LAN or DMZ allow rule:

Navigate to the Policy| Rules and Policies | Access Rules page.
Select From WAN To LAN (This could be changed to the zone of the Mail Server).
Add the following Allow Rule.

Action: Allow
Service: SMTP
Source: Positini Network
Destination: Mail Server Public

5) Creating a NAT Policy

Navigate to the Manage | Policies | Rules | NAT Policies page.
Create a new NAT Policy with following values.

Original Source: Positini Network
Translated Original: Original
Original Destination: Mail Server Public
Translated Destination: Mail Server Private
Original Service: SMTP
Translated Service: Original
Inbound Interface: X1
Outbound Interface: Any
Check Create a reflexive policy: This will create an outbound NAT Policy with Original Source as the private IP and the Translated Source as the public IP of the mail server.

How to Test

From a computer on the Internet try to telnet on port 25 to the public ip address of the Mail Server and it should fail. Likewise, try sending a mail and you should be able to receive it.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Creating an Address Object for the IP Addresses of the hosted service:

Login to the SonicWall management interface.
Navigate to Manage | Policies | Address Objects.
Create a new Address Object with following values.

Name: Postini Network
Zone: WAN
Type: Network (This could be changed to Range or Host as required)
Network: 207.126.144.0
Netmask: 255.255.240.0
Creating an Address Object for the WAN IP Address of the Mail Server with following values.

Name: Mail Server Public
Zone: WAN
Type: Host
IP Address: 1.1.1.2
Creating an Address Object for the LAN (or DMZ) IP Address of the Mail Server with following values.

Name: Mail Server Private
Zone: LAN (This could be changed to the zone of the Mail Server)
Type: Host
IP Address: 192.168.1.2

Creating a WAN to LAN or DMZ allow rule:

Navigate to the Manage | Policies | Rules | Access Rules page.
Select From WAN To LAN (This could be changed to the zone of the Mail Server).
Add the following Allow Rule.

Action: Allow
Service: SMTP
Source: Positini Network
Destination: Mail Server Public

Creating a NAT Policy

Navigate to the Manage | Policies | Rules | NAT Policies page.
Create a new NAT Policy with following values.

Original Source: Positini Network
Translated Original: Original
Original Destination: Mail Server Public
Translated Destination: Mail Server Private
Original Service: SMTP
Translated Service: Original
Inbound Interface: X1
Outbound Interface: Any
Check Create a reflexive policy: This will create an outbound NAT Policy with Original Source as the private IP and the Translated Source as the public IP of the mail server.

How to Test

From a computer on the Internet try to telnet on port 25 to the public ip address of the Mail Server and it should fail. Likewise, try sending a mail and you should be able to receive it.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Crating an Address Object for the IP Addresses of the hosted service

Login to the SonicWall management interface.
Navigate to Network | Address Objects.
Create a new Address Object with following values.

Name: Postini Network
Zone: WAN
Type: Network (This could be changed to Range or Host as required)
Network: 207.126.144.0
Netmask: 255.255.240.0
Creating an Address Object for the WAN IP Address of the Mail Server with following values.

Name: Mail Server Public
Zone: WAN
Type: Host
IP Address: 1.1.1.2
Creating an Address Object for the LAN (or DMZ) IP Address of the Mail Server with following values.

Name: Mail Server Private
Zone: LAN (This could be changed to the zone of the Mail Server)
Type: Host
IP Address: 192.168.1.2

Creating a WAN to LAN or DMZ allow rule

Navigate to the Firewall | Access Rules page.
Select From WAN To LAN (This could be changed to the zone of the Mail Server).
Add the following Allow Rule.

Action: Allow
Service: SMTP
Source: Positini Network
Destination: Mail Server Public

Creating a NAT Policy

Navigate to the Network | NAT Policies page.
Create a new NAT Policy with following values.

Original Source: Positini Network
Translated Original: Original
Original Destination: Mail Server Public
Translated Destination: Mail Server Private
Original Service: SMTP
Translated Service: Original
Inbound Interface: X1
Outbound Interface: Any
Check Create a reflexive policy: This will create an outbound NAT Policy with Original Source as the private IP and the Translated Source as the public IP of the mail server.

How to Test

From a computer on the Internet try to telnet on port 25 to the public ip address of the Mail Server and it should fail. Likewise, try sending a mail and you should be able to receive it.

Not Finding Your Answers?

ASK THE COMMUNITY

Was This Article Helpful?

YES NO

Allow only authorized SMTP servers to communicate with your mail server

Description

Resolution

Resolution for SonicOS 7.X

Resolution for SonicOS 6.5

Resolution for SonicOS 6.2 and Below

Related Articles

Categories

Not Finding Your Answers?

Was This Article Helpful?

Article Helpful Form

Article Not Helpful Form

Follow Us

Subscribe to newsletter

Stay In Touch