Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 19 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 18948 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall blocking

Cris Kolkman

Hello,

I have added a Network Definitions group called "Blocked Attackers" and added several IP addresses and IP subnets.
I added a firewall rule (on position 1) with the following settings:

Sources: Blocked Attackers
Services: Any
Destinations: Any
Action: Drop (also tried reject)

The rule is enabled but I still see the IP address appear on the SMTP proxy trying to authenticate.

Am I missing something here?



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Cris Kolkman

    Ok

    You have a DNAT rule.

    You have "authenticated Users can relay" enabled

    1) Is there any other user inside that send emails on port 25?

    2) how outside user clients open their mailbox?

  • 0 in reply to Ol Deda

    There is no DNAT rule (in SMTP config it's just relaying mail to the Exchange server).
    "Authenticated users can relay" is enabled indeed.

    1) Don't really know what you mean, only the Exchange server is relaying outgoing mail to the UTM
    2) They open their mailbox via OWA or Exchange ActiveSync on mobile phones

  • 0 in reply to Cris Kolkman

    Why is "Authenticated users can relay" Enabled?

    Why is Transparent Mode is not enabled. Any firewall rule about port 25 can compromise your IP spam reputation if Transparent is not enabled

  • 0 in reply to Ol Deda

    Because I'm using AD users to relay mail, also for any cloud apps I might be using in the future.
    I could have choosen for Allowed Hosts/Network but in this case I have choosen for Allowed Users/Groups.

    I don't really know why I should enable or disable Transparent Mode, it's still not really clear for me what it does and what the impact is for the current configuration.

    I have to say I'm quite new to UTM so maybe that's the whole issue? :)

  • 0 in reply to Cris Kolkman

    What company do you work for. [:D] 

    How they let you: that users can send emails directly from UTM and not from Exchange Server??? 

    I think that you configured that AD users can send email, any user is configured to do that. Then, what is the point?

  • 0 in reply to Ol Deda

    The users are not sending directly to the UTM, Exchange is configured to relay mail to the UTM using a username/password.

    I have done this config with future apps in mind which might relay mails to the UTM before sending them to the outside world :)
    Like I said, I also could have chosen to add the Exchange server as a trusted host in the Relaying tab, but in this case I have chosen to let the Exchange server authenticate using username/password.

    This is not for a company btw, UTM Home edition :)

  • 0 in reply to Cris Kolkman

    Ok than you can do some test :)

    1. Enable Transparent Mode.

    2. Disable Authenticated Can Relay

    3. Add Exchange Server to  Relaying 

    4. Skip from Transparent those attackers

    And that's it

  • 0 in reply to Ol Deda

    Okay I have done step 1 - 3 but I don't know what you mean with:

    4. Skip from Transparent those attackers

  • 0 in reply to Cris Kolkman

    ADD Blocked Attackers you created for firewall rule 1, to  Skip Transparent Mode Hosts/Nets under Advanced tab of SMTP. 
    Now Blocked Attackers  will be subject of Firewall or NAT rules. You may test delete the firewall rule as well, those hosts will not contact your SMTP anymore

  • 0 in reply to Ol Deda

    Thank you, I did that.

    Seems that the drop is not really working though:

    2018:04:25-15:29:21 mailserver exim-in[31820]: 2018-04-25 15:29:21 SMTP connection from (User) [181.214.206.44]:25680 closed by QUIT

    While I added the subnet 181.214.206.0/24 to the Blocked Attackers group.

Unfiltered HTML