This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall blocking

Hello,

I have added a Network Definitions group called "Blocked Attackers" and added several IP addresses and IP subnets.
I added a firewall rule (on position 1) with the following settings:

Sources: Blocked Attackers
Services: Any
Destinations: Any
Action: Drop (also tried reject)

The rule is enabled but I still see the IP address appear on the SMTP proxy trying to authenticate.

Am I missing something here?

This thread was automatically locked due to age.

0 Ol Deda over 5 years ago

Smtp ports (25) are subject of Email Protection Service, when "Transparent Mode" is enabled.
Skip those host or groups from "Transparent Mode", then those host will be handled by the firewall rule
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 5 years ago in reply to Ol Deda

Hello oldeda,

Thank you for your answer.
Transparent mode is not enabled on the Advanced tab for Email Protection > SMTP.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 5 years ago in reply to Cris Kolkman

For what you use Email Protection i mean what is the configuration?
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 5 years ago in reply to Ol Deda

Hello,

It is configured as incoming and outgoing SMTP server.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 5 years ago in reply to Cris Kolkman

I mean you have email server behind
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 5 years ago in reply to Ol Deda

Yes, the UTM 9 is relaying the mail to an Exchange server and the Exchange server is relaying outgoing mail to the UTM 9.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 5 years ago in reply to Cris Kolkman

Ok

You have a DNAT rule.

You have "authenticated Users can relay" enabled

1) Is there any other user inside that send emails on port 25?

2) how outside user clients open their mailbox?
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 5 years ago in reply to Ol Deda

There is no DNAT rule (in SMTP config it's just relaying mail to the Exchange server).
"Authenticated users can relay" is enabled indeed.

1) Don't really know what you mean, only the Exchange server is relaying outgoing mail to the UTM
2) They open their mailbox via OWA or Exchange ActiveSync on mobile phones
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 5 years ago in reply to Cris Kolkman

Why is "Authenticated users can relay" Enabled?

Why is Transparent Mode is not enabled. Any firewall rule about port 25 can compromise your IP spam reputation if Transparent is not enabled
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 5 years ago in reply to Ol Deda

Because I'm using AD users to relay mail, also for any cloud apps I might be using in the future.
I could have choosen for Allowed Hosts/Network but in this case I have choosen for Allowed Users/Groups.

I don't really know why I should enable or disable Transparent Mode, it's still not really clear for me what it does and what the impact is for the current configuration.

I have to say I'm quite new to UTM so maybe that's the whole issue? :)
Cancel
Vote Up 0 Vote Down

Cancel