On 2004.12.28 11:22, Vijay Kumar - vijay@xxxxxxxxxxxxxx wrote:
Hi,
I want to allow my internal network to only connect to some specific email
servers.
Apart from these mail server I want to block port 25 and 110 from my
internal network to anywhwere. I am doing the following :
iptables -I INPUT -I eth0 --dport 25 -d !<ip addr of mail server> -j
REJECT
This does not seem to block the port 25 traffic. Where am I going wrong?
The INPUT rules only apply to packets destined for the firewall computer.
Try this in FORWARD instead.
Another thing, a default drop policy might be simpler to administer.
Then only specifically allowed packets would be forwarded.
This approach more closely matches your intention, stated above.
Also, the approach above is hard to extend to multiple mail servers.
If you do this though, it is a good idea to log unexpected dropped
packets and analyze them to see what is being blocked.
Kindly help.
Regards,
Vijay Kumar
--
Jim Laurino
nfcan.x.jimlaur@xxxxxxxx
Please reply to the list.
Only mail from the listserver reaches this address.
