How to Restrict access to SMTP proxy?

davidqdc · #1 (**permalink**) 02-02-2004, 02:55 PM

Under ASL 4.020, I use the SMTP proxy for antivirus and antispam filtering into Exchange. However, our setup is such that all email is filtered externally, before hitting our wire; thus, there should only be incoming SMTP connections from specific IPs.
I've tried to implement a packet filter to deny all and accept from the specific upstream IPs, but it doesn't work.
Can anyone shed some light on this, please?
Thanks!
-David

SecApp · #2 (**permalink**) 02-02-2004, 04:19 PM

proxies sit outside the firewall and are unaffected by rules.
So how can you do what you want to do, I am not sure;
the only way you could restrict is through a setting on the SMTP proxy...

davidqdc · #3 (**permalink**) 02-02-2004, 04:52 PM

Right. I had seen someone suggest setting up 'ipfilter.local' for proxy filter blocking. Would that apply in the case of the SMTP proxy? Else, is there a configuration option for Exim to only allow connections from specific IPs?

Unfortunately, I'm not [yet] too familiar with Exim configuration. I guess on this, I'll ping Astaro support. It seems like something desirable to do...

SecApp · #4 (**permalink**) 02-03-2004, 12:57 AM

That's your only shot: an Exim tweak or an SMTP proxy setting. The ipfilter local is for the firewall rules; proxies are unaffected by that...

JimmyM · #5 (**permalink**) 02-03-2004, 03:22 PM

You could use the "I" option in your IPTABLES rule definition and it should insert the rule at the beginning of the stack.
Create 1 rule for each allowed IP:
Rule to allow : IPTABLES I INPUT -s "allowed IP" -p tcp -d "ASL external IP" -dport 25 -j AUTO_INPUT

You should use the target AUTO_INPUT, I believe, so that the traffic would then have to pass the other rules for incoming traffic.

Rule to drop : IPTABLES I INPUT -s any -d "ASL external IP" -dport 25 -j DROP

This one will DROP smtp traffic not allowed by the earlier rules before it gets to the ASL generated AUTO_INPUT target.

Give it a shot. It is a "hack", but since it's reducing allowed traffic it should pose limited risk.