Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 41 subscribers
  • Views 532 views
  • Users 0 members are here
Options
Suggested

Email Protection auto generated MTA Firewall Rule

jtaylor

Hi, I can't seem to find a clear answer as to why the auto generated MTA firewall rule is needed. As I understand it, in MTA mode emails are being 'handled' by the firewall rather than just traffic passing through it, so access should be controlled by 'Device access' not 'Firewall rules'. To complicate the matter further, the docs state that "By default, firewall rules apply only to outbound mails.".

Auto creating a wide open firewall rule that isn't needed seems a strange way to approach security!



Edited TAGs
[edited by: Raphael Alganes at 3:10 PM (GMT -8) on 11 Nov 2024]
Parents
  • +1

    Essentially we are using the MTA rule to give the Exim (MTA Service) a way to communicate through the system. 

    This rule is used for allowing the own traffic for email traffic (out and inbound).

    You should not delete it, as it might corrupt your email traffic, as the firewall cannot find a rule to allow outgoing / inbound email traffic.

    You can modify the rule, if you want to, the core principle, it should still exists. I also saw people disable the rule (not deleting) and it is fine.

    Essentially the rule transform the firewall to perform transparent SMTP scanning as well, by forwarding the traffic (port25) through the firewall to the MTA. 

    __________________________________________________________________________________________________________________

Reply
  • +1

    Essentially we are using the MTA rule to give the Exim (MTA Service) a way to communicate through the system. 

    This rule is used for allowing the own traffic for email traffic (out and inbound).

    You should not delete it, as it might corrupt your email traffic, as the firewall cannot find a rule to allow outgoing / inbound email traffic.

    You can modify the rule, if you want to, the core principle, it should still exists. I also saw people disable the rule (not deleting) and it is fine.

    Essentially the rule transform the firewall to perform transparent SMTP scanning as well, by forwarding the traffic (port25) through the firewall to the MTA. 

    __________________________________________________________________________________________________________________

Children
No Data
Unfiltered HTML