>If blocking ports via your router, be aware that your server will need to
>send traffic outbound on ports other than 25. For example, if a remote
>server sends incoming packets on port 25, your responses back to the remote
>server will be on a random port > 1024. If you only let 25 back out, your
>server will never respond to the remote server.
THIS IS MISLEADING INFORMATION.
Any decent firewall will NOT have this terrible requirement. Any firewall
that has this terrible requirement should be thrown out. Specifically, if
a firewall does have this requirement, no inbound traffic of any sort can
be accepted!
If all you need is incoming SMTP (port 25) traffic (most need more, such as
POP3, DNS, web, etc., but let's keep it simple), you just need to tell your
firewall to allow incoming traffic to port 25.
Every Internet TCP/IP connection has 2 endpoints, the client (who initiates
the connection) and the server (who accepts the connection). The client
and the server each have an IP address and a port; those uniquely identify
the connection. When a client connects to the mailserver, it says "I want
to make a connection on port 25 (by the way, please send your response back
to port 1086)". Since you have no way of knowing (or even caring) what the
client port is, the firewall is expected to ignore it. The mailserver will
then send an "OK, I'll accept your SMTP connection" message from port 25 on
the server to port 1086 on the client. Again, the firewall neither knows
nor cares what the client port is.
The only times that the client port is important is if [1] you want to
restrict outgoing packets (such as not allowing someone on the mailserver
to connect to remote websites), in which case a stateful firewall will know
the difference between a program on the mailserver connecting to port 1086
on a remote server vs. a response to port 1086 on a remote client), or [2]
If you have ultra-high security measures, requiring the people connecting
to the server to be running special software on their servers. #1 is
handled automatically by any decent firewall without having to tell it
anything about ports >1024, and #2 isn't appropriate to mailservers.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
