This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 2 different ISP's on 2 NIC's but need 1 SMTP NIC

Hi All,
I want to use Email Protection for my mailserver.
My UTM has 2 (Public) NIC's. NIC 1 ISP A and NIC 2 ISP B.
ISP A does not allow SMTP traffic so I want to receive mail on NIC 2 (ISP B).
But when I enable Email Protection, both NIC's are able to receive e-mails?!
I will receive an angry e-mail from my ISP A that my port is open, I want to prevent this.

Is it even possible to use Email Protection on 1 NIC (2) and not on both NIC's?

TIA

This thread was automatically locked due to age.

0 BrucekConvergent over 11 years ago

Not currently (maybe some tricks with SNAT/DNAT would work) ... by default the SMTP proxy shows up as available on all interfaces if it's enabled. There is a feature request at UTM (Formerly ASG) Feature Requests: Hot (1232 ideas) for this, you may want to go vote on it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

A blackhole DNAT on the correct interface (1st Destination setting) should work.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 11 years ago

maybe masquearding smtp with wan2 is the key
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 11 years ago in reply to Ol Deda

but then the 2 IP's will still be listening on the outside, I guess...
Only IP 1 will be a "/dev/null"....
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

It should satisfy your ISP; they will see the port as 'closed/stealth'.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

Agreed with Bruce and Barry. 'DNAT : Any -> SMTP -> NIC 1 (Address) : to {non-existant IP}'

You can't do it with a Firewall rule because of what I call Rule #2:
In general, a packet arriving at an interface is handled only by one of the following, in order:
DNATs first, then VPNs and Proxies and, finally, manual Routes and Firewall rules.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 11 years ago in reply to BAlfson

ok, thank you all for your suggestions!
Cancel
Vote Up 0 Vote Down

Cancel