Allow external public IP Address to access to SMTP relay

Hello eclipse79 , 

Thank you for reaching out to the community, yes that would be the right way to do it | enable the SMTP relay on the WAN side. And you can mention the specific host/networks you want it to be relayed:

Hello eclipse79 , 

Thank you for reaching out to the community, yes that would be the right way to do it | enable the SMTP relay on the WAN side. And you can mention the specific host/networks you want it to be relayed:

Thank you

I discovered that enabling SMTP for WAF it is pubblically visible by all IP address through 25 port. Only "Allow relay from hosts" IP can send email, but I don't like to let my SMTP relay to be visible...

I contacted support, and it seems that there is no way to get what I want ...

You could do a Blacklist DNAT for everything except your WAN IP. 

This would be the workaround for your situation. 

What you do: 
Configure it as usual. Additionally setup a DNAT Rule for a own created Internetv4 object. 

The internet v4 object could be something like: 

You create an additional object like Internetv4 which leaves out your particular IP Address. 

With the new object(s) you will generate a blackhole NAT rule and move everything else to nowhere. 

https://doc.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/FirewallRulesBlackHoleDNATRuleCreate/index.html 

Essentially this would lead to: Every Host in WAN will be redirected to nothing and not to the SMTP MTA except your wanted IP. This will work, is a little bit more work to create but fulfills the requirement.