Block Traffic for Userportal, Webadmin, SMTP to specific Sophos additional address

Hallo and welcome to the UTM Community!

See #2 in Rulz (last updated 2021-02-16) to understand why the solution is a DNAT like the following:

     DNAT : Internet IPv4 -> {WebAdmin, SMTP, Userportal port} -> {1.2.3.5} : to {240.0.0.1}

Cheers - Bob

Hi,

i tried DNAT : Internet IPv4 -> {SMTP} -> {additional IP address on interface} : to {240.0.0.1} and guess what, it is not working. Still an open SMTP and still handling mail traffic.

Hmm.  Please insert a picture of the Edit of your DNAT.  Also show us something that indicates that SMTP traffic came in on the additional address instead of the primary IP.

Cheers - Bob

This is the Sender:

This is the DNAT:

and this is the log:

This is the Sender:

This is the DNAT:

and this is the log:

Ah, an internal device.  There are several ways that might succeed, Michael.  One would be that the user was authenticated as the log indicates.

Another would be that the test device is using something other than SMTP, so try using the "Email Messaging" Service Group instead of "SMTP" in the DNAT.

A better test would be to use an external test like https://mxtoolbox.com/diagnostic.aspx.

Cheers - Bob

thx for the troubble i caused

I took another physical interface, excluded it from SMTP (meaning: i did not put it in the allowed interfaces list) and moved the additionel IP addresse to the new interface. This may not be an option for everybody, but it worked for me pretty well.